Elastic Search中多搜索核心字段的处理疑问：自定义拼接字段与_all映射的功能对比

Great question—this is a common point of confusion when starting out with Elasticsearch, so let’s break it down clearly.

Should you concatenate core search fields into a new custom field? #

You can do this, but it’s not strictly necessary. Let’s weigh the pros and cons:

• Pros:
  • You get full control over exactly which fields are included, and can add custom logic (like separators between field values) if needed.
  • Search queries can be simpler since you only target one field instead of multiple.
• Cons:
  • It adds extra storage overhead (you’re duplicating data from your core fields).
  • You have to maintain this field manually—any time you update a source field (like name), you’ll need to re-generate the concatenated field to keep it in sync.
  • You lose visibility into which original field the search match came from (unless you add extra tracking, which adds more complexity).

A common alternative is using a multi_match query to target all your core fields directly. This avoids duplicating data and lets you keep context about which fields matched. Here’s an example:

{
  "query": {
    "multi_match": {
      "query": "your search term",
      "fields": ["name", "product_info", "description"]
    }
  }
}

What about the _all field? #

The _all field was a special built-in field that automatically concatenated values from most fields into a single indexed field. In terms of core functionality (searching across multiple fields via one field), it’s similar to a custom concatenated field—but with key caveats:

• Deprecated/Removed: _all was deprecated in Elasticsearch 6.x and completely removed in 7.x+. It’s not recommended for any new projects.
• Less Control: While you could configure which fields to include/exclude, it was less flexible than a custom solution.
• Official Replacement: The modern alternative is using the copy_to parameter in your mapping. This lets you define a custom combined field (like search_all) and automatically copy values from your core fields into it. Here’s how that looks:

{
  "mappings": {
    "properties": {
      "name": {
        "type": "text",
        "copy_to": "search_all"
      },
      "product_info": {
        "type": "text",
        "copy_to": "search_all"
      },
      "description": {
        "type": "text",
        "copy_to": "search_all"
      },
      "search_all": {
        "type": "text"
      }
    }
  }
}

This approach gives you the convenience of automatic concatenation (no manual updates needed) and full control over which fields are included—making it the best of both worlds.

Final Recommendations #

• If you’re using Elasticsearch 7.x or newer: Skip _all entirely. Use copy_to to create a custom combined field, or stick with multi_match queries if you want to avoid extra storage.
• Only manually concatenate fields if you need very specific logic (like modifying values before combining) that copy_to doesn’t support.

内容的提问来源于stack exchange，提问作者Karanam Krishna