Could you open Inspector in Discover and paste the query part of the request and the highlight part of the response? You should see something like this in the request:
Could you open Inspector in Discover and paste the query part of the request and the highlight part of the response? You should see something like this in the request:
Discover is correctly highlight what is receives from an Elasticsearch response. I will move this to the ES forum, perhaps they have more insight into what is happening.
@majagrubic would have to confirm this, but I believe discover uses require_field_match: false on the highlighting config - so that'll highlight all of those terms. Here are the docs for that. In other words - I think kibana is asking for ES to do this. Kibana has a "debug" link in discover that'll show you the search it sent to ES. If it has that parameter in it then it's asking for ES to highlight all of the fields.
If it isn't then maybe it's something to do with the lucene query. I'm not particularly good with those, but I wonder if it should be source.as.organization.name:/.*[Mm][Aa][Ll][Ww][Aa][Rr][Ee].*/ - without the space between the name and the term. I don't the query string query syntax much - I tend to use explicit queries for this sort of thing. Kibana let's you build those as "filters" I think. So, like, if you make a filter on source.as.organization.name of type regexp and pass that regex that'll be more explicit.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.