{
  "query": {
    "query_string": {
      "analyze_wildcard": true,
      "fields": [
        "user.keyword"
      ],
      "query": "bob"
    }
  }
}

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"query_shard_exception","reason":"failed to create query: {\n  \"bool\" : {\n    \"must\" : [\n      {\n        \"match_all\" : {\n          \"boost\" : 1.0\n        }\n      },\n      {\n        \"query_string\" : {\n          \"query\" : \"bob\",\n          \"default_field\" : \"*\",\n          \"fields\" : [\n            \"referer^1.0\"\n          ],\n          \"type\" : \"best_fields\",\n          \"default_operator\" : \"or\",\n          \"max_determinized_states\" : 10000,\n          \"enable_position_increments\" : true,\n          \"fuzziness\" : \"AUTO\",\n          \"fuzzy_prefix_length\" : 0,\n          \"fuzzy_max_expansions\" : 50,\n          \"phrase_slop\" : 0,\n          \"analyze_wildcard\" : true,\n          \"escape\" : false,\n          \"boost\" : 1.0\n        }\n      },\n      {\n        \"range\" : {\n          \"@timestamp\" : {\n            \"from\" : null,\n            \"to\" : null,\n            \"include_lower\" : true,\n            \"include_upper\" : true,\n            \"boost\" : 1.0\n          }\n        }\n      }\n    ],\n    \"adjust_pure_negative\" : true,\n    \"boost\" : 1.0\n  }\n}","index_uuid":"vRkJQI87Qx-6ZNea2nupgg","index":"logstash-0"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"logstash-0","node":"Eba1LxIMRo2CgXn3QLwvYA","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n  \"bool\" : {\n    \"must\" : [\n      {\n        \"match_all\" : {\n          \"boost\" : 1.0\n        }\n      },\n      {\n        \"query_string\" : {\n          \"query\" : \"bob\",\n          \"default_field\" : \"*\",\n          \"fields\" : [\n            \"referer^1.0\"\n          ],\n          \"type\" : \"best_fields\",\n          \"default_operator\" : \"or\",\n          \"max_determinized_states\" : 10000,\n          \"enable_position_increments\" : true,\n          \"fuzziness\" : \"AUTO\",\n          \"fuzzy_prefix_length\" : 0,\n          \"fuzzy_max_expansions\" : 50,\n          \"phrase_slop\" : 0,\n          \"analyze_wildcard\" : true,\n          \"escape\" : false,\n          \"boost\" : 1.0\n        }\n      },\n      {\n        \"range\" : {\n          \"@timestamp\" : {\n            \"from\" : null,\n            \"to\" : null,\n            \"include_lower\" : true,\n            \"include_upper\" : true,\n            \"boost\" : 1.0\n          }\n        }\n      }\n    ],\n    \"adjust_pure_negative\" : true,\n    \"boost\" : 1.0\n  }\n}","index_uuid":"vRkJQI87Qx-6ZNea2nupgg","index":"logstash-0","caused_by":{"type":"query_validation_exception","reason":"Validation Failed: 1: [query_string] cannot use [fields] parameter in conjunction with [default_field];"}}}]},"status":400}
    at http://localhost:5701/bundles/kibana.bundle.js?v=15976:233:1369
    at Function.Promise.try (http://localhost:5701/bundles/commons.bundle.js?v=15976:95:30830)
    at http://localhost:5701/bundles/commons.bundle.js?v=15976:95:30200
    at Array.map (<anonymous>)
    at Function.Promise.map (http://localhost:5701/bundles/commons.bundle.js?v=15976:95:30155)
    at callResponseHandlers (http://localhost:5701/bundles/kibana.bundle.js?v=15976:233:985)
    at http://localhost:5701/bundles/kibana.bundle.js?v=15976:232:21395
    at processQueue (http://localhost:5701/bundles/commons.bundle.js?v=15976:39:9912)
    at http://localhost:5701/bundles/commons.bundle.js?v=15976:39:10805