Query the index defined default_field when a field isn't explicitly provided (#15101)

In 7.0 ES put a limit on the number of fields that a query can expand to. Since a search term without an explicit field selection hits all fields by default, a kibana user could get an error if the index they're searching against has more than 1024 fields. With lucene, the ES admin could fix this by changing the default_field in their index settings. Kuery still had a problem though, because multi_match did not support default_field. The ES team kindly added default_field support to multi_match for us, so this PR updates Kuery to rely on default_field when a user submits a query without an explicit field.

src/ui/public/kuery/functions/__tests__/and.js

@@ -53,9 +53,9 @@ describe('kuery functions', function () {
         );
       });
 
-      it('should wrap a literal argument with an "is" function targeting all fields', function () {
+      it('should wrap a literal argument with an "is" function targeting the default_field', function () {
         const literalFoo = nodeTypes.literal.buildNode('foo');
-        const expectedChild = ast.toElasticsearchQuery(nodeTypes.function.buildNode('is', '*', 'foo'), indexPattern);
+        const expectedChild = ast.toElasticsearchQuery(nodeTypes.function.buildNode('is', null, 'foo'), indexPattern);
         const node = nodeTypes.function.buildNode('and', [literalFoo]);
         const result = and.toElasticsearchQuery(node, indexPattern);
         const resultChild = result.bool.filter[0];

src/ui/public/kuery/functions/__tests__/is.js

@@ -57,6 +57,20 @@ describe('kuery functions', function () {
         expectDeepEqual(result, expected);
       });
 
+      it('should return an ES multi_match query using default_field when fieldName is null', function () {
+        const expected = {
+          multi_match: {
+            query: 200,
+            type: 'phrase',
+            lenient: true,
+          }
+        };
+
+        const node = nodeTypes.function.buildNode('is', null, 200);
+        const result = is.toElasticsearchQuery(node, indexPattern);
+        expectDeepEqual(result, expected);
+      });
+
       it('should return an ES multi_match query when fieldName is "*"', function () {
         const expected = {
           multi_match: {

src/ui/public/kuery/functions/__tests__/not.js

@@ -48,9 +48,9 @@ describe('kuery functions', function () {
         expect(result.bool.must_not).to.eql(ast.toElasticsearchQuery(childNode, indexPattern));
       });
 
-      it('should wrap a literal argument with an "is" function targeting all fields', function () {
+      it('should wrap a literal argument with an "is" function targeting the default_field', function () {
         const literalFoo = nodeTypes.literal.buildNode('foo');
-        const expectedChild = ast.toElasticsearchQuery(nodeTypes.function.buildNode('is', '*', 'foo'), indexPattern);
+        const expectedChild = ast.toElasticsearchQuery(nodeTypes.function.buildNode('is', null, 'foo'), indexPattern);
         const node = nodeTypes.function.buildNode('not', literalFoo);
         const result = not.toElasticsearchQuery(node, indexPattern);
         const resultChild = result.bool.must_not;

src/ui/public/kuery/functions/__tests__/or.js

@@ -53,9 +53,9 @@ describe('kuery functions', function () {
         );
       });
 
-      it('should wrap a literal argument with an "is" function targeting all fields', function () {
+      it('should wrap a literal argument with an "is" function targeting the default_field', function () {
         const literalFoo = nodeTypes.literal.buildNode('foo');
-        const expectedChild = ast.toElasticsearchQuery(nodeTypes.function.buildNode('is', '*', 'foo'), indexPattern);
+        const expectedChild = ast.toElasticsearchQuery(nodeTypes.function.buildNode('is', null, 'foo'), indexPattern);
         const node = nodeTypes.function.buildNode('or', [literalFoo]);
         const result = or.toElasticsearchQuery(node, indexPattern);
         const resultChild = result.bool.should[0];

src/ui/public/kuery/functions/and.js

@@ -15,7 +15,7 @@ export function toElasticsearchQuery(node, indexPattern) {
     bool: {
       filter: children.map((child) => {
         if (child.type === 'literal') {
-          child = nodeTypes.function.buildNode('is', '*', child.value);
+          child = nodeTypes.function.buildNode('is', null, child.value);
         }
 
         return ast.toElasticsearchQuery(child, indexPattern);

src/ui/public/kuery/functions/is.js

@@ -29,6 +29,15 @@ export function toElasticsearchQuery(node, indexPattern) {
       }
     };
   }
+  else if (fieldName === null) {
+    return {
+      multi_match: {
+        query: value,
+        type: 'phrase',
+        lenient: true,
+      }
+    };
+  }
   else if (fieldName === '*' && value === '*') {
     return { match_all: {} };
   }

src/ui/public/kuery/functions/not.js

@@ -11,7 +11,7 @@ export function buildNodeParams(child, serializeStyle = 'operator') {
 export function toElasticsearchQuery(node, indexPattern) {
   let [ argument ] = node.arguments;
   if (argument.type === 'literal') {
-    argument = nodeTypes.function.buildNode('is', '*', argument.value);
+    argument = nodeTypes.function.buildNode('is', null, argument.value);
   }
 
   return {

src/ui/public/kuery/functions/or.js

@@ -15,7 +15,7 @@ export function toElasticsearchQuery(node, indexPattern) {
     bool: {
       should: children.map((child) => {
         if (child.type === 'literal') {
-          child = nodeTypes.function.buildNode('is', '*', child.value);
+          child = nodeTypes.function.buildNode('is', null, child.value);
         }
 
         return ast.toElasticsearchQuery(child, indexPattern);