I'm trying to search for an IP (example query on search page: 127.0.0.1) in the filebeat-* index, and the results indicate 0. If I put *.ip:127.0.0.1 it works fine (I get results with desintation and source IPs). Appears to be the same with KQL or lucene.
My concern and question is, shouldn't kibana be searching all fields if I don't specify one? I'm running kibana 7.6.1.