Search should run against @message as a default.

Description

By default searches run without a field specified. ES's behavior is to then run the search against a field "_any" which internally rolls up all the other fields. However maintaining this _any field eats a not insignificant portion of disk. To resolve this dependency on the existence of "_any" for unspecified field searches the default behavior should be that searches run against @message if no field is explicitly specified.

Activity

Show:
Richard Pijnenburg
December 17, 2012, 4:51 AM

No work will be done on the current logstash-web and will be replaced by Kibana ( www.kibana.org )
Currently there are 2 options.

1) Wait until Kibana is runnable from logstash.
2) Run kibana your self.

Assignee

Logstash Developers

Reporter

Dave Rawks

Labels

None

Fix versions

Affects versions

Configure