@Ar21, did you ever resolve this? We also are migrating from 2.4 -> 6.2 and seeing slow catch all queries. We're not using the _all field directly, but we see in Kibana 6.2 that if we search for something simple like "cron:session" the result will take 50+ seconds to come back. If we are specific and search for some_message_field:"cron:session" then the result comes back in ~800ms.