I'm with Kibana 7.10, and in discover, I try to just search without the field name. It seems to me for some fields, this works, for others, not.
For example, I have a string field fields.log_type: "log-type"
In Kibana, I search just enter "log-type" , it finds all entries with fields.log_type: set to "log-type". So far so good.
However, searching for a user.name without the field name, brings up some, where the username somehow matches a word in the message: field, but not where the username matches the user.name: field. When I do a search alike: user.name: "root" it will find all of them.
Similarly, searching for IPs, i.e. just entering an IP: "10.20.30.40" brings up nothing, but when I search for: source.ip: "10.20.30.40" it will find them all. Searching for IPs is even worse than usernames, as it might be any of source.ip, destination.ip client.ip etc....
I don't understand why searching without giving the field name works for the fields.log_type: but not for others?