1st I don't think you have a config issue.
2nd the proper KQL Syntax for both your searches are
Those should always work as expected (you can skip the rest if that is all you need)
Why just putting in Nuremberg works is a little more nuanced.
destination.geo.city_name is of type
When you just enter a Text like
Nuremberg with out the field name Discover will search for that text in
keyword and / or
text fields it is a short hand search and it can be a bit confusing but still useful for a quick search.
In this case it matches
destination.geo.city_name exactly which is the only way to match a keyword.
If you have
"San Jose" as a city name in
destination.geo.city_name you would need to search on
"San Jose" in quotes otherwise the tokenizer will split it into
Jose (without quotes) and it will not find either because the
destination.geo.city_name is a
keyword and the value is
"San Jose" so it must be an exact match.
When you just enter
"188.8.131.52" that is only found in the
ip types fields so search does not find it (not to mention it tokenizes it into 200 180 192 206 if you put it in without quotes)
So in short when you just put text in the search bar without the field names it will search the
text fields for a token that matches and the
keyword fields for an exact match
if you enter EN-US without quotes it will break it up into EN and US....
Yes Elastic is a Search Engine ... and it works like one
So long story use the KQL syntaxt described here ... its pretty easy, there is type ahead built into the search bar and you will get expected results.
Hope this helps a bit...