Skip to content

KQL wildcard and case insensitive search not working when searching all fields #24586

@LucaWintergerst

Description

@LucaWintergerst

Kibana version: 6.4.2

Elasticsearch version: 6.4.2

Server OS version: elastic cloud

Browser version: latest chrome
Browser OS version: latest chrome
Original install method (e.g. download page, yum, from source, etc.): elastic cloud
Describe the bug:
The query behaviour and functionality changes when searching all fields, compared to searching one specific field when using KQL.

Steps to reproduce:
1.
Sample data:

PUT my_index/doc/1
{
  "my_fieldname": "my_term"
}
  1. create index pattern
  2. search in discover:

Case insensitive search:
my_fieldname:my_Term - 1 hit
my_Term - no hits

Wildcards:
my_fieldname:my_t* - 1 hit
my_t* - no hits

Searching all fields does kind of work in general, but only if the exact term is being searched for.

my_term - 1 hit

Expected behavior: I would expect the search to behave the same way, no matter if I add a field name or not.

Any additional context: The reason why this fails is that a query with no fields in it gets converted to a multi_match query, which does a term query on the index under the hood. Therefore searching for a term my_t* with the asterisk at the end.

The "old" lucene syntax always worked for the case described above, as it's always using a query_string_query which does all of the necessary wildcard and analysis steps needed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Feature:KQLKQLTeam:VisualizationsTeam label for Lens, elastic-charts, Graph, legacy editors (TSVB, Visualize, Timelion) t//

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions