Kibana version: 6.4.2
Elasticsearch version: 6.4.2
Server OS version: elastic cloud
Browser version: latest chrome
Browser OS version: latest chrome
Original install method (e.g. download page, yum, from source, etc.): elastic cloud
Describe the bug:
The query behaviour and functionality changes when searching all fields, compared to searching one specific field when using KQL.
Steps to reproduce:
1.
Sample data:
PUT my_index/doc/1
{
"my_fieldname": "my_term"
}
- create index pattern
- search in discover:
Case insensitive search:
my_fieldname:my_Term - 1 hit
my_Term - no hits
Wildcards:
my_fieldname:my_t* - 1 hit
my_t* - no hits
Searching all fields does kind of work in general, but only if the exact term is being searched for.
my_term - 1 hit
Expected behavior: I would expect the search to behave the same way, no matter if I add a field name or not.
Any additional context: The reason why this fails is that a query with no fields in it gets converted to a multi_match query, which does a term query on the index under the hood. Therefore searching for a term my_t* with the asterisk at the end.
The "old" lucene syntax always worked for the case described above, as it's always using a query_string_query which does all of the necessary wildcard and analysis steps needed.
Kibana version: 6.4.2
Elasticsearch version: 6.4.2
Server OS version: elastic cloud
Browser version: latest chrome
Browser OS version: latest chrome
Original install method (e.g. download page, yum, from source, etc.): elastic cloud
Describe the bug:
The query behaviour and functionality changes when searching all fields, compared to searching one specific field when using KQL.
Steps to reproduce:
1.
Sample data:
Case insensitive search:
my_fieldname:my_Term- 1 hitmy_Term- no hitsWildcards:
my_fieldname:my_t*- 1 hitmy_t*- no hitsSearching all fields does kind of work in general, but only if the exact term is being searched for.
my_term- 1 hitExpected behavior: I would expect the search to behave the same way, no matter if I add a field name or not.
Any additional context: The reason why this fails is that a query with no fields in it gets converted to a
multi_matchquery, which does a term query on the index under the hood. Therefore searching for a termmy_t*with the asterisk at the end.The "old" lucene syntax always worked for the case described above, as it's always using a query_string_query which does all of the necessary wildcard and analysis steps needed.