Elasticsearch query_string wildcard syntax

Question

Apparently I can query ES with the following wildcard query_string :

curl 'http://localhost:9200/my-index/_search?pretty' -d '{
  "query": {
    "query_string": {
      "query": "*:sw?ft"
    }
  }
}'

Does this query against _all field ? which makes it equivalent to:

curl 'http://localhost:9200/my-index/_search?pretty' -d '{
  "query": {
    "query_string": {
      "default_field" : "_all"
      "query": "sw?ft"
    }
  }
}'

what if _all is disabled in indexing? I couldn't find the documentation for it.

Thanks in advance.

Answer 1

A query_string with the searching command set to *:sw?ft will be transformed to something like the following (assuming your my-index index has a single my_field field, for example):

(_field_names:sw?ft | _all:sw?ft | _index:sw?ft | _parent:sw?ft | _uid:sw?ft | _type:sw?ft | _routing:sw?ft | _version:sw?ft | _timestamp:sw?ft | _source:sw?ft | _size:sw?ft | my_field:sw?ft | _id:sw?ft | _ttl:sw?ft | _boost:sw?ft)

So, the wildcard before : will be expanded to all the fields in the index, not only your own defined fields. Be very careful with wildcards in query_string , they can affect in a bad way the performance of the cluster.

So, to answer your question, * will be expanded to all the fields of the index, including _all . If you would have used just sw?ft as searching string then this, by default, would have been used _all .

Answer 2

First of all, that's documentation for query_string query:

• https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html

And it has answers to both of your questions:

When not explicitly specifying the field to search on in the query string syntax, the index.query.default_field will be used to derive which field to search on. It defaults to _all field.

So, if _all field is disabled, it might make sense to change it to set a different default field.