I want to disable the "_all" field because it consumes too much space and I really don't have a use for it. However Kibana 4.1 seems to default to that field for Visualization queries.
I found an old topic that said modifying the KibanaConfig.rb file and set up the Primary_field = "_all" to Primary_field = "message" would do the trick.
However, I cannot find the KibanaConfig.rb anywhere in my installation.
Was it removed in this version? If so ... how can I change that behavior?