Wild card search required instead of searching to a specific field name in elasticsearch

Elastic Stack Elasticsearch
1

I am working on elasticsearch 2.3.3. While querying the search, I am getting results only when field name is specified. ie

   GET /mydocs/_search?q=file.content:cat

but I need to search without giving the field name. How is it possible?

2

You can either search the _all field, which is a special field that is a concatenation of all fields, or you can use more complex queries like the multi_match query, or combinations of booleans.

For more background and theory, see: Multi-field Search from The Definitive Guide

3

User is not aware of any field names,they will enter the text to search(I am using kibana). We internally need to check whether the given text is contained in the title or attached content. Is it possible using kibana?

4

Hm, did you disable the _all field in your mapping? By default, if a query doesn't specify a field to search, the _all field is searched. This includes searches originating in Kibana.

If you don't want everything to go into the _all field, you can set include_in_all: false for certain fields, or disable it completely and build a new one using copy_to, then set index.query.default_field to that new field. See: https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-all-field.html#disabling-all-field

5

How do I set this property? I am using c# NEST to create index. Could you please show me how to do it?
My create index code:

    var fullNameFilters = new List<string> { "lowercase", "snowball" };
        client.CreateIndex("mydocs", c => c
              .Settings(st => st
                        .Analysis(anl => anl
                        .Analyzers(h => h
                            .Custom("full", ff => ff
                                 .Filters(fullNameFilters)
                                 .Tokenizer("standard"))
                            )
                            .TokenFilters(ba => ba
                                .Snowball("snowball", sn => sn
                                    .Language(SnowballLanguage.English)))                    
                            ))
                         .Mappings(mp => mp
                         .Map<IndexDocument>(ms => ms
                         .AutoMap()
                         .Properties(ps => ps
                             .Nested<Attachment>(n => n
                                 .Name(sc => sc.File)
                             .AutoMap()
                             ))
                        .Properties(at => at
                        .Attachment(a => a.Name(o => o.File)
                        .FileField(fl=>fl.Analyzer("full"))
                        .TitleField(t => t.Name(x => x.Title)
                        .Analyzer("full")
                        .TermVector(TermVectorOption.WithPositionsOffsets)
                        )))
                       
                        ))                        
                        );
6

I'm afraid I'm not very familiar with the NEST client. It's a mapping configuration, so it needs to be set via the Put Mappings API. And it needs to be done before data is indexed to work properly (since ES needs to copy the data into that field during index-time)

You should be able to use NEST's mapping endpoints (https://www.elastic.co/guide/en/elasticsearch/client/net-api/current/auto-map.html#_manual_mapping) and copy the syntax from the prior link about the _all field.

7

Thank you @polyfractal . I got the solution

http://stackoverflow.com/questions/37967551/set-index-query-default-field-using-nest-client-c-sharp