elasticsearch/docs/reference/mapping/params/doc-values.asciidoc

[[doc-values]]
=== `doc_values`

Most fields are <<mapping-index,indexed>> by default, which makes them
searchable. The inverted index allows queries to look up the search term in
unique sorted list of terms, and from that immediately have access to the list
of documents that contain the term.

Sorting, aggregations, and access to field values in scripts requires a
different data access pattern.  Instead of looking up the term and finding
documents, we need to be able to look up the document and find the terms that
it has in a field.

Doc values are the on-disk data structure, built at document index time, which
makes this data access pattern possible. They store the same values as the
`_source` but in a column-oriented fashion that is way more efficient for
sorting and aggregations. Doc values are supported on almost all field types,
with the __notable exception of `analyzed` string fields__.

All fields which support doc values have them enabled by default. If you are
sure that you don't need to sort or aggregate on a field, or access the field
value from a script, you can disable doc values in order to save disk space:

[source,js]
--------------------------------------------------
PUT my_index
{
  "mappings": {
    "properties": {
      "status_code": { <1>
        "type":       "keyword"
      },
      "session_id": { <2>
        "type":       "keyword",
        "doc_values": false
      }
    }
  }
}
--------------------------------------------------
// CONSOLE
<1> The `status_code` field has `doc_values` enabled by default.
<2> The `session_id` has `doc_values` disabled, but can still be queried.