# Not searching @message field by default (using Kibana) **URL:** \ **Category:** Elasticsearch\ **Created:** [May 30, 2013, 8:26am UTC](https://discuss.elastic.co/t/not-searching-message-field-by-default-using-kibana/12187 "2013-05-30T08:26:49Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![subin](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@subin](https://discuss.elastic.co/u/subin)\ **Post date:** [May 30, 2013, 8:26am UTC](https://discuss.elastic.co/t/not-searching-message-field-by-default-using-kibana/12187/1 "2013-05-30T08:26:49Z")
I've updated ES template disabling '\_all' field searching and set the default field to search for as '@message'. But now when I enter a search-string (from message part of a log) into Kibana search bar, it doesn't return any result. I will then have to modify the search as - @message:"a\_string\_in\_log\_message" to return the expected results. I mean, the query should return results without including "@message:" along with the search-string right? Please let me know and I'm attaching my template also. Thanks, -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![stoked](https://avatars.discourse-cdn.com/v4/letter/s/e19adc/32.png) [@stoked](https://discuss.elastic.co/u/stoked)\ **Post date:** [June 2, 2013, 4:26am UTC](https://discuss.elastic.co/t/not-searching-message-field-by-default-using-kibana/12187/2 "2013-06-02T04:26:59Z")
Did you modify the Primary\_field setting in KibanaConfig.rb? On Thursday, May 30, 2013 1:26:49 AM UTC-7, vims wrote: > I've updated ES template disabling '\_all' field searching and set the > default field to search for as '@message'. > But now when I enter a search-string (from message part of a log) into > Kibana search bar, it doesn't return > any result. I will then have to modify the search as - > > @message:"a\_string\_in\_log\_message" > > to return the expected results. I mean, the query should return results > without including "@message:" along > with the search-string right? Please let me know and I'm attaching my > template also. > > Thanks, -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![subin](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@subin](https://discuss.elastic.co/u/subin)\ **Post date:** [June 3, 2013, 8:00am UTC](https://discuss.elastic.co/t/not-searching-message-field-by-default-using-kibana/12187/3 "2013-06-03T08:00:59Z")
Solved. You were right. I had to change Primary\_field = '\_all' to Primary\_field = '@message' Thanks, On Sun, Jun 2, 2013 at 9:56 AM, stoked [darrenfoo@gmail.com](mailto:darrenfoo@gmail.com) wrote: > Did you modify the Primary\_field setting in KibanaConfig.rb? > > On Thursday, May 30, 2013 1:26:49 AM UTC-7, vims wrote: > > > I've updated ES template disabling '\_all' field searching and set the > > default field to search for as '@message'. > > But now when I enter a search-string (from message part of a log) into > > Kibana search bar, it doesn't return > > any result. I will then have to modify the search as - > > > > @message:"a\_string\_in\_log\_\*\*message" > > > > to return the expected results. I mean, the query should return results > > without including "@message:" along > > with the search-string right? Please let me know and I'm attaching my > > template also. > > > > Thanks, > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/5AcSejTdxbU/unsubscribe?hl=en-US](https://groups.google.com/d/topic/elasticsearch/5AcSejTdxbU/unsubscribe?hl=en-US) > . > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:33am UTC](https://discuss.elastic.co/t/not-searching-message-field-by-default-using-kibana/12187/4 "2017-07-06T02:33:22Z")