I'm curious about the rationale for indexing urls as keyword by default (in my case it's nginx.access.url, but I noticed it's the same for apache and others) .
The documentation states that Keyword fields are searchable by their exact value only. Now, I think it's pretty common to search logs for parts of urls: Show me timings for all images, show me timings for all images of a specific customer, etc.
This way the url field is barely usable by default.
What am I missing here?