Search should run against @message as a default.

Description

By default searches run without a field specified. ES's behavior is to then run the search against a field "_any" which internally rolls up all the other fields. However maintaining this _any field eats a not insignificant portion of disk. To resolve this dependency on the existence of "_any" for unspecified field searches the default behavior should be that searches run against @message if no field is explicitly specified.

Assignee

Logstash Developers

Reporter

Dave Rawks

Labels

None

Fix versions

Affects versions

Configure