Our cluster is still running Elasticsearch 6.8, so I'm looking at getting it upgraded to Elasticsearch 7. The Kibana Upgrade Assistant is flagging a couple of hundred indices with this message
This index has [4234] fields, which exceeds the automatic field expansion limit of 1024 and does not have [index.query.default_field] set, which may cause queries which use automatic field expansion, such as query_string, simple_query_string, and multi_match to fail if fields are not explicitly specified in the query.
The warning message says that queries "may" fail. Which I take to mean they may not fail. I can't find information about what exactly failure means in this context, (unexpected results? an error message? both? other?) or what would determine if a search fails or not.
If, with Elasticsearch 7, someone tries to do a search in Kibana on an index with 4234 fields without specifying a field and index.query.default_field isn't set, what might happen?
Essentially, how about if instead of having conversations with people about what index.query.default_field should be set to on various indices, I just ignore the warning?
)