I asked around, and most people didn't even think we supported spaces in field names. That's probably an indication that you shouldn't be doing that in the first place. FWIW, convention would seem to imply using _ in your field names in place of a space.
That said, there seems to be 2 ways to query a field with a space in it. The first is to simply escape the space in the field name, such as "query": "my\\ field:value"
. So, in Kibana, using a \ and no space before or after the : seems to be the way to do it. Given the original question, my\ field:searchterm
should work.
The second uses the default_field parameter. Kibana simply passes whatever you put in that field into the "query" value when it's a string, but it will pass the entire contents into a bool query if you use valid JSON instead. So, I think you can query that field with the following as well: { "query_string": { "default_field": "my field", "query": "searchterm" }}
, but I haven't tried that directly myself.