# Highlighting wrong when index.query.default\_field is set

**URL:** <https://discuss.elastic.co/t/highlighting-wrong-when-index-query-default-field-is-set/69125>\
**Category:** Elasticsearch\
**Created:** [December 15, 2016, 8:02am UTC](https://discuss.elastic.co/t/highlighting-wrong-when-index-query-default-field-is-set/69125 "2016-12-15T08:02:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\
**Post date:** [December 15, 2016, 8:02am UTC](https://discuss.elastic.co/t/highlighting-wrong-when-index-query-default-field-is-set/69125/1 "2016-12-15T08:02:33Z")

</div>

Hi,

I have an index with a mapping that includes `"index.query.default_field": "message"`. When I make a search against this index, using just a "\*" for query, and set highlighting options, the results I get back have the string "Message" highlighted, if it occurs in the value of the `message` field. I suspect this is because of the way elasticsearch handles internally the `default_field` setting. Like this:

```
GET _search
{
  "size": 1,
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "*",
            "analyze_wildcard": true
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": 1481787693324,
              "lte": 1481787693324,
              "format": "epoch_millis"
            }
          }
        }
      ]
    }
  },
  "highlight": {
    "fields": {
      "*": {}
    },
    "require_field_match": false
  }
}

{
  "took": 1683,
  "timed_out": false,
  "_shards": {
    "total": 321,
    "successful": 321,
    "failed": 0
  },
  "hits": {
    "total": 7,
    "max_score": 2,
    "hits": [
      {
        "_index": "log-qradar-20161215",
        "_type": "logs",
        "_id": "AVkBbdlgkS35GOS6IIl1",
        "_score": 2,
        "_source": {
          "input": "1514/tcp",
          "@timestamp": "2016-12-15T07:41:33.324Z",
          "port": 57367,
          "@version": "1",
          "message": "<13>Dec 15 08:38:51 hostname.dot.com AgentDevice=WindowsLog\tAgentLogFile=Security\tPluginVersion=7.2.2.984723\tSource=Microsoft-Windows-Security-Auditing\tComputer=hostname.dot.com\tOriginatingComputer=ip.address\tUser=\tDomain=\tEventID=4662\tEventIDCode=4662\tEventType=16\tEventCategory=4608\tRecordNumber=13543854504\tTimeGenerated=1481787526\tTimeWritten=1481787526\tLevel=Log Always\tKeywords=Audit Failure\tTask=SE_ADT_DSACCESS_DSACCESS\tOpcode=Info\tMessage=",
          "tags": [],
          "source_ip": "ip.address"
        },
        "highlight": {
          "message": [
            "=Log Always\tKeywords=Audit Failure\tTask=SE_ADT_DSACCESS_DSACCESS\tOpcode=Info\t<em>Message</em>="
          ]
        }
      }
    ]
  }
}

```

I believe this shouldn't be happening, but I'm quite new to elasticsearch so I'm not sure. Is this the expected behaviour or not?

Thanks for your thoughts.

Best,  
Dan

PS: I'm aware of [Unexpected highlighted words matching with value of index.query.default\_field](https://discuss.elastic.co/t/unexpected-highlighted-words-matching-with-value-of-index-query-default-field/41857/2) but that was posted in the Kibana forum so it may not have gotten the proper attention. That's why I decided to post here in the Elasticsearch forum as well.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 12, 2017, 8:02am UTC](https://discuss.elastic.co/t/highlighting-wrong-when-index-query-default-field-is-set/69125/2 "2017-01-12T08:02:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.