[SOLVED] A little question regarding Kibana search

Elastic Stack Kibana
1

Hi all,

I'm reading "Apache Lucene - Query Parser Syntax" official documentation.

I can see in Terms section:

Note: The analyzer used to create the index will be used on the terms and phrases in the query string. So it is important to choose an analyzer that will not interfere with the terms used in the query string.

I try to figure out how it works exactly. In my elasticsearch mapping I have a lot of fields that have their own custom analyzer. So when I make a terms query like "toto tata" in Kibana toolbar, how lucene choose the right analyzer if I didn't specified the field ? It tries with all analyzer from all fields ?

Thanks in advance for your answer.
Alex

2

If you don't specify the field name in the query, the _all field is used. This is a string field that contains a concatenation of values from all other fields in the document. By default the _all field uses the standard analyzer but this can be overridden in the mapping.

You can read a bit more about the _all field over here: https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-all-field.html

3

Thanks for your reply.

In my environment the _all field is disable...

So in that case, it means that it will use the _source field ? If yes, with which analyzer ?

Thanks,
Alex

4

I get the answer in the official doc:

"If the _all field is disabled, then URI search requests and the query_string and simple_query_string queries will not be able to use it for queries (see Using the _all field in queries). You can configure them to use a different field with the index.query.default_field."

Have a nice day,
Alex