# Query\_string with \_all disabled still returns results

**URL:** <https://discuss.elastic.co/t/query-string-with--all-disabled-still-returns-results/93992>\
**Category:** Elasticsearch\
**Created:** [July 20, 2017, 5:28pm UTC](https://discuss.elastic.co/t/query-string-with--all-disabled-still-returns-results/93992 "2017-07-20T17:28:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JeffH](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeffh/32/821_2.png) [@JeffH](https://discuss.elastic.co/u/JeffH)\
**Post date:** [July 20, 2017, 5:28pm UTC](https://discuss.elastic.co/t/query-string-with--all-disabled-still-returns-results/93992/1 "2017-07-20T17:28:53Z")

</div>

I am running elasticsearch 5.3.1 and trying to understand the effects of disabling the \_all field, however, after disabling I am still getting results on query\_string queries where no field is specified. This is the same question as [Query\_string still returns results although \_all field is disabled](https://discuss.elastic.co/t/query-string-still-returns-results-although--all-field-is-disabled/80916), however, it was not clearly answered.

Here are repro steps:

```
PUT mytest
{
  "mappings": {
    "Foo": {
      "dynamic": false,
      "_all": {"enabled": false},
      "properties": {
        "text_field": {
          "type": "text"
        }
      }
    }
  }
}

POST mytest/Foo
{
  "text_field": "search stuff"
}

GET mytest/_search?q=search

```

The \_search query returns the one document, however, I was expecting to see no results.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [July 28, 2017, 8:48am UTC](https://discuss.elastic.co/t/query-string-with--all-disabled-still-returns-results/93992/2 "2017-07-28T08:48:36Z")

</div>

I think that @dakrone might be able to comment.

Actually when you run

```auto
GET mytest/_search?q=_all:search

```

You get no hits (tested on 5.5.1). I know that we changed the behavior about `_all` field which is removed in 6.0. That might explain this.

Related breaking change: [https://www.elastic.co/guide/en/elasticsearch/reference/6.x/breaking\_60\_mappings\_changes.html#\_the\_literal\_\_all\_literal\_meta\_field\_is\_now\_disabled\_by\_default](https://www.elastic.co/guide/en/elasticsearch/reference/6.x/breaking_60_mappings_changes.html#_the_literal__all_literal_meta_field_is_now_disabled_by_default)

---

<div class="post-metadata">

**Author:** ![dakrone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dakrone/32/23351_2.png) [@dakrone](https://discuss.elastic.co/u/dakrone)\
**Post date:** [August 1, 2017, 7:26pm UTC](https://discuss.elastic.co/t/query-string-with--all-disabled-still-returns-results/93992/3 "2017-08-01T19:26:55Z")

</div>

This is because of the new `all_fields` mode that the `query_string` is using when no field is specified. It mimics the behavior of the `_all` field by expanding the query to be all fields that are queryable by default.

For the background, see: [https://github.com/elastic/elasticsearch/pull/20925](https://github.com/elastic/elasticsearch/pull/20925)

You can also see exactly how the query is being rewritten with the following:

```auto
GET /mytest/_validate/query?explain&rewrite
{
  "query": {
    "query_string": {
      "query": "search"
    }
  }
}

```

Which returns:

```auto
{
  "valid" : true,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "failed" : 0
  },
  "explanations" : [
    {
      "index" : "mytest",
      "valid" : true,
      "explanation" : "text_field:search"
    }
  ]
}

```

You can see the `text_field:search` explanation, which explains why this matches the document.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 29, 2017, 7:27pm UTC](https://discuss.elastic.co/t/query-string-with--all-disabled-still-returns-results/93992/4 "2017-08-29T19:27:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.