Hi there,
I've observed that most of my users are searching in Kibana with queries like my nice query, which expands to a multi_match search with type: best_fields, triggering separate searches for each token in the phrase and impacting performance at peak times.
However, after analyzing audit logs, it seems that most of the time users actually intend to search for the exact phrase, "my nice query" (or message: "my nice query"). I’ve already configured index.query.default_field to message, so explicitly specifying message: isn’t necessary.
Is there a way, either in Elasticsearch or Kibana, to adjust the default multi_match type from best_fields to phrase, or alternatively, to fully disable best_fields?
Thanks in advance for any insights!
Kind regards,