You can use the default field to facilitate highlighting on a SAS Visual Investigator search. The highlighting analyzer logic works on  one field when both of the following conditions are met:

• Each field in an entity has the Include in free text searches option set to true.
• You copy this option into the default field.

The highlighting configuration for the default field uses the "plain" method of applying the highlighting. Elasticsearch chooses this method by default. You cannot change this method by altering the sand config because the default field is hardcoded.

An issue occurs, however, when the default field for an entity exceeds one million characters because you are unable to apply highlighting.

Workaround

To circumvent this issue, change the highlighting type on the default field to Fast Vector Highlighter (FVH).