# Substituting the \`\_all\` mapping

**URL:** <https://discuss.elastic.co/t/substituting-the-all-mapping/122754>\
**Category:** Elasticsearch\
**Created:** [March 6, 2018, 5:24pm UTC](https://discuss.elastic.co/t/substituting-the-all-mapping/122754 "2018-03-06T17:24:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![headless](https://avatars.discourse-cdn.com/v4/letter/h/f0a364/32.png) [@headless](https://discuss.elastic.co/u/headless)\
**Post date:** [March 6, 2018, 5:24pm UTC](https://discuss.elastic.co/t/substituting-the-all-mapping/122754/1 "2018-03-06T17:24:28Z")

</div>

Hey I'm pretty new to ES and since the `_all` - mapping is deprecated since ES 6.0.0 Id like to know how to get similar results.  
What I want to do is search all fields (nested ones inclusive) for a String. As far as I understood it, \_all used to concatenate all fields to a single String on which i could run my query on.

Having this query

```
{
"from": 0, "size": 100,
"query": {
    "bool": {
        "must": [
            {
                "wildcard": {
                    "data.leaf_cert.all_domains": {"value": "*" + q + "*"},
                }
            }
        ]
    }
}
}

```

how would I achieve to search for all fields instead of only for `data.leaf_cert.all_domains` ?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 6, 2018, 5:44pm UTC](https://discuss.elastic.co/t/substituting-the-all-mapping/122754/2 "2018-03-06T17:44:37Z")

</div>

If you are new, some advices first:

- Don't use wildcards starting with `*`
- Don't use wildcards at all

If you do a query string query in 6.x it will act as it was acting before but without the need of having a `_all` field. Which is why this has been removed.

If you want to control on which fields you want to search you can do a [multimatch](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/query-dsl-multi-match-query.html) query.

Or you can use the `copy_to` feature to copy the content of fields inside another one at index time and search in that field.

---

<div class="post-metadata">

**Author:** ![headless](https://avatars.discourse-cdn.com/v4/letter/h/f0a364/32.png) [@headless](https://discuss.elastic.co/u/headless)\
**Post date:** [March 7, 2018, 8:41am UTC](https://discuss.elastic.co/t/substituting-the-all-mapping/122754/3 "2018-03-07T08:41:43Z")

</div>

thanks for the quick reply.  
I came to use regex instead of wildcards (but I wonder, why would there be an option to use wildcards, if the use of it is deprecated?)

when using the multimatch query, is it possible to set the fields to `[*]` so that every field i selected?

you know, i want to query all fields (which could be 100+) so instead of writing a mapping with at least 100+ fields I like to have an option to query every field.

but when I understood you correctly I really have to do it manually? i.e. with `copy_to` or`multimatch`?  
I think there should really be something like "query all fields, but field foo and field bar"

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 7, 2018, 9:36pm UTC](https://discuss.elastic.co/t/substituting-the-all-mapping/122754/4 "2018-03-07T21:36:23Z")

</div>

> but I wonder, why would there be an option to use wildcards, if the use of it is deprecated?

I never said it's deprecated. I'm just quoting [the doc](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/query-dsl-wildcard-query.html) here:

> Note that this query can be slow, as it needs to iterate over many terms. In order to prevent extremely slow wildcard queries, a wildcard term should not start with one of the wildcards `*` or `?`.

> I came to use regex instead of wildcards

Let me quote [the doc](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/query-dsl-regexp-query.html):

> The performance of a regexp query heavily depends on the regular expression chosen. Matching everything like `.*` is very slow as well as using lookaround regular expressions. If possible, you should try to use a long prefix before your regular expression starts. Wildcard matchers like `.*?+` will mostly lower performance.

> when using the multimatch query, is it possible to set the fields to [\*] so that every field i selected?

> when using the multimatch query, is it possible to set the fields to [\*] so that every field i selected?

Yes as per doc says: [Multi Match Query | Elasticsearch Reference [6.2] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/query-dsl-multi-match-query.html#_literal_fields_literal_and_per_field_boosting)

> so instead of writing a mapping with at least 100+ fields I like to have an option to query every field.

Sure. Anyway in case you want to use `copy_to`, you can look at [dynamic templates](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/dynamic-templates.html) to automate that.

Note that using a simple query string query or a query string query does not require you to mention any field. It will act as it was with the `_all` field. See [\_all field | Elasticsearch Reference [6.2] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/mapping-all-field.html#querying-all-field)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2018, 9:36pm UTC](https://discuss.elastic.co/t/substituting-the-all-mapping/122754/5 "2018-04-04T21:36:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.