Use default_field in highlight_query instead of all_fields

[lukasolson]

Fixes #13096.

This PR changes the behavior of highlighting to use "default_field": "*" instead of "all_fields": true.

See #9671 for the original PR.

[Bargs]

There may be a bug in ES, or default_field: * may not be an exact replacement for all_fields after all. I'm getting the following error when I search for a number with no field specified:

Here's what my highlight query looked like:

  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {
        "highlight_query": {
          "bool": {
            "must": [
              {
                "query_string": {
                  "query": "200",
                  "analyze_wildcard": true,
                  "default_field": "*"
                }
              },
              {
                "range": {
                  "@timestamp": {
                    "gte": 1498684188295,
                    "lte": 1501276188295,
                    "format": "epoch_millis"
                  }
                }
              }
            ],
            "filter": [],
            "should": [],
            "must_not": []
          }
        }
      }
    },
    "fragment_size": 2147483647
  }

[Bargs]

I also had another related thought. I wonder if we should take the opportunity here to set default_field: * as the default in query:queryString:options and just get rid of this doc_table:highlight:all_fields setting entirely. If I remember correctly we only used the highlight query in 5.x because forcing all_fields on all indices would technically be a breaking change. In 6.0 we could make that change and just delete all this code. Users who have a default_field set in their index patterns could just update query:queryString:options.

Am I missing any reason why we wouldn't want to do that?

[lukasolson]

@Bargs That's a good point. It would be a breaking change for 6.0 since some users would have to update the setting as you mentioned, but I think it would be super nice to get rid of this code anyway. It all feels pretty hacky to me.

[lukasolson]

There are two kinds of users that might have to update their advanced settings if we do that: Those who have a default_field set in their index, and those who have, in the past, already modified the query:queryString:options advanced setting (to include the default_field parameter). Is that right?

[Bargs]

and those who have, in the past, already modified the query:queryString:options advanced setting (to include the default_field parameter).

I suppose that's true, yeah.

[Bargs]

@lukasolson I re-tested with a build of the most recent commit in ES master and I can no longer reproduce that error, so perhaps it was a bug that's already been fixed. This LGTM. If you want we could merge this as-is to avoid spamming users' deprecation logs and consider removal as a separate issue.

[weltenwort]

Seems to work as expected against elastic/elasticsearch@315319b.