concept _all in category elasticsearch
This is an excerpt from Manning's book Elasticsearch in Action.
Normally a query runs on a specific field, such as q=name:elasticsearch, but in this case we didn’t specify any field because we wanted to search in all fields. In fact, Elasticsearch uses, by default, a special field named _all, in which all fields’ contents are indexed. We’ll look more at the _all field in chapter 3, but for now it’s nice to know that such a query without an explicit field name goes there.
In addition to the fields you define in your documents, such as name or date, Elasticsearch uses a set of predefined fields to enrich them. For example, there’s a _all field, where all the document’s fields are indexed together. This is useful when users search for something without specifying the field—they can search in all fields. These predefined fields have their own configuration options, and we’ll discuss them later in this chapter.
Let’s start by looking at _source, which lets you store the documents you index, and _all, which lets you index all their content in a single field.
Just as _source is storing everything, _all is indexing everything. When you search in _all, Elasticsearch returns a hit regardless of which field matches. This is useful when users are looking for something without knowing where to look; for example, searching for “elasticsearch” may match the group name “Elasticsearch Denver” as well as the tag elasticsearch on other groups.
Running a search from the URI without a field name will search on _all by default:
curl 'localhost:9200/get-together/group/_search?q=elasticsearch'