Kibana - missing text highlighting for multi-field mapping

Question

I am experimenting with ECS - Elastic Common Schema. We need to highlight text search for the field error.stack_trace . This field is a multi-field mapped defined here

I just did a simple test running Elasticsearch and Kibana 7.17.4 one field defined as multi-field and one with single field.

PUT simple-index-01
{
    "mappings": {
      "properties": {
        "stack_trace01": { "type": "text" },
            "stack_trace02": {
              "fields": {
                "text": {
                  "type": "text"
                }
              },
              "type": "wildcard"
            }
          }
        }
}

POST simple-index-01/_doc 
{ 
  "@timestamp" : "2022-06-07T08:21:05.000Z", 
  "stack_trace01": "java.lang.NullPointerException: null",
  "stack_trace02": "java.lang.NullPointerException: null"
}

Is it a Kibana expected behavior not to highlight multi-fields?

Answer 1

wildcard type will be not available to search using full text query as mentioned in documentaion (it is part of keyword type family):

The wildcard field type is a specialized keyword field for unstructured machine-generated content you plan to search using grep-like wildcard and regexp queries.

So when you try below query it will not return result and this is the reason why it is not highlghting your stack_trace02 field in discover.

POST simple-index-01/_search
{
  "query": {
    "match": {
      "stack_trace02": "null"
    }
  }
}

But below query will give result:

{
  "query": {
    "wildcard": {
      "stack_trace02": {
        "value": "*null*"
      }
    }
  }
}

You can create index mapping something like below and your parent type field should text type:

PUT simple-index-01
{
  "mappings": {
    "properties": {
      "stack_trace01": {
        "type": "text"
      },
      "stack_trace02": {
        "fields": {
          "text": {
            "type": "wildcard"
          }
        },
        "type": "text"
      }
    }
  }
}

You can now use stack_trace02.wildcard when you want to search wildcard type of query.

There is already open issue on similar behaviour but it is not for wildcard type.