Search code examples
elasticsearchlogstashkibanakibana-4elastic-stack

Can _all be removed from elastic search when using kibana4

I read that dropping the _all can save a lot of index space, but i do not understand if kibana4 needs this special field or not and everyone seens to avoid that question.

So if i drop the _all field, what might stop working in kibana4?

Solution

  • _all is not required in Kibana. However, if you're doing free text search on the Discover tab, Kibana will issue a query_string query on the default field, which is _all.

    So if you disable _all you'll need to explicitly specify the fields you're targeting in your query, i.e. instead of typing some free text in Kibana, you'll need to type content:"some free text" OR title:"some free text" (i.e. match either the content or the title field).

    Another option is to specify the setting index.query.default_field when creating your index.

    Also see this issue