Allow highlighting of arbitrary fields

[Bargs]

From a user in IRC:

For many queries, the part we query for, and thus gets highlighted, is not what we're looking for. We know those fields, we specified them in the query. Find all ssh logs with a username of 'bob', for example. Highlighting 'bob' doesn't help. Highlighting the src IP would though.

This would be particularly useful in dashboards, where you might want to highlight a field across many searches and even visualizations.

Hypothetically, the above query might look something like this:

+type:ssh +username:"bob" _hl_:"[src.ip, src.location]"

[KelSolaar]

Hi,

I would be super interested to get that functionality, I will paste here an example I gave on your discussion forum:

I made a search in Kibana that matches component is not matching! and as a result yield messages like this as expected:

[ 2018-05-16 20:48:29,081 5300 WARNING ] Size of "nemo" component is not matching!

What I would like to do is highlight nemo in the UI instead of component is not matching! as it currently happens (with a yellow background colour).

[kertal]

Closing this because it's not planned to be resolved in the foreseeable future. It will be tracked in our Icebox and will be re-opened if our priorities change. Feel free to re-open if you think it should be melted sooner.