Remove default_field from query:queryString:options #16232
Labels
Comments
ruflin
added a commit
to ruflin/beats
that referenced
this issue
May 22, 2018
In Elasticsearch 7.0 there is a limit of 1024 fields (see elastic#5275). As Metricbeat exceeds the limit of 1024 fields per index it has to be defined which the default fields are as otherwise Elasticsearch returns an error. This change set the index config option `index.query.default_field`. To fields chosen to be searchable are all string and keyword values as these are the ones that I would expect users to put directly in the search without specifying a field. For all numbers I expect that the exact field is specified. This PR also removes all presets from dashboards which did set default_fields as they were `*`. In Kibana the default `*` was removed also in master: elastic/kibana#16232
exekias
pushed a commit
to elastic/beats
that referenced
this issue
May 22, 2018
In Elasticsearch 7.0 there is a limit of 1024 fields (see #5275). As Metricbeat exceeds the limit of 1024 fields per index it has to be defined which the default fields are as otherwise Elasticsearch returns an error. This change set the index config option `index.query.default_field`. To fields chosen to be searchable are all string and keyword values as these are the ones that I would expect users to put directly in the search without specifying a field. For all numbers I expect that the exact field is specified. This PR also removes all presets from dashboards which did set default_fields as they were `*`. In Kibana the default `*` was removed also in master: elastic/kibana#16232
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
In 7.0 ES added a limit to the number of fields that can be queried. In 6.0 we started using
default_field: *to get consistent highlighting in Discover even when a user had a mix of indices with and without an_allfield. This is causing an issue with Beats pre-defined dashboards because the number of fields in a Beats index surpasses the query limit, yet we're telling it to query all fields. In 7.0, the_allfield will be completely gone so we no longer really need thedefault_fieldsetting. Let's remove it in 7.0.Fixes #15863
The text was updated successfully, but these errors were encountered: