bug in query_string : syntax "field:(v1 v2)" does not work anymore on keyword properties

[fbaligand]

Describe the issue:
On Elasticsearch 5.x, in a query_string query, we can use syntax field:(v1 v2 v3) which is the same than field:(v1 OR v2 OR v3)
It does not work anymore with elasticsearch 6.1 on keyword properties : no results returned although field:(v1 OR v2 OR v3) syntax works fine.
It looks like a regression.

Elasticsearch version : 6.1.0 and 6.1.3

JVM version : 1.8.0_131

OS version : Linux RHEL 6

Steps to reproduce:
In Kibana Console :

PUT index1/doc/1
{
"f1": "v1"
}

POST index1/_search
{
  "query": {
    "query_string": {
      "query": "f1.keyword:(v1 v2)"
    }
  }
}

=> returns nothing

POST index1/_search
{
  "query": {
    "query_string": {
      "query": "f1.keyword:(v1 OR v2)"
    }
  }
}

=> returns the doc

POST index1/_search
{
  "query": {
    "query_string": {
      "query": "f1:(v1 v2)"
    }
  }
}

=> returns the doc

[danielmitterdorfer]

Thanks for raising the issue and the reproduction scenario. Can somebody in @elastic/es-search-aggs please have a look at this one?

[jimczi]

This is expected, in 6.x whitespaces are not considered as operators anymore so the query f1:(v1 v2) will pass v1 v2 to the analyzer of the field f1 which then decides how the input should be parsed (for a keyword field it will treat v1 v2 as a single term). If you want to clearly separate v1 and v2 you'll need to add an explicit operator between the terms (AND, OR).
I'll add an example in the docs (and the breaking changes) regarding how we treat whitespaces because the current example is not descriptive enough.

[fbaligand]

Hi @jimczi

OK, so if it is finally a breaking change and so, only a "docs" issue, I think that this doc page especially should be updated (referenced by Kibana search bar) :
https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#query-string-syntax

[fbaligand]

Thanks for the fix @jimczi :)

[mainameiz]

Whitespaces are not considered operators, this means that new york city will be passed "as is" to the analyzer configured for the field. If the field is a keyword field the analyzer will create a single term new york city and the query builder will use this term in the query. If you want to query each term separately you need to add explicit operators around the terms (e.g. new AND york AND city).

If the field is a keyword field

It means that for text fields it will split on whitespaces as earlies?

[jimczi]

@mainameiz these are closed prs, if you have questions please use the discuss forum where we can provide better support:
https://discuss.elastic.co/c/elasticsearch