Creating a raw field mapping searchable by regexes with spaces

[Supermathie (Michael Brown)]

On Elastic 6.6, I'm trying to create an index that supports a regex search when the regex has spaces in it.

I see older references to not_analyzed that no longer apply to modern versions of Elasticsearch.

I've tried, for example:

PUT /_template/other
{
  "index_patterns": ["other", "other-*"],
  "mappings": {
    "other": {
      "properties": {
        "message": {
          "index": true,
          "type": "text",
          "fields": {
            "raw": {
              "type": "text",
              "analyzer": "keyword"
            }
          }
        }
      }
    }
  }
}

and variations:

            "raw": {
              "type": "keyword"
            }

but can't figure out how to get it to work with a simple document like:

POST /other-testing/other
{
  "message": "hello there I'm testing spaces"
}

and a search such as:

{
  "regexp": {
    "message": {
      "value": ".*testing .*"
    }
  }
}

[Mark_Harwood]

The problem is you create a variant of the field called "raw" but didn't refer to it in the query by it's name (message.raw).
Working example below:

DELETE test
PUT test
{
  "mappings": {
	"_doc": {
	  "properties": {
		"message": {
		  "type": "text"
		  ,"fields":{
			"raw":{
			  "type":"keyword"
			}
		  }
		}
	  }
	}
  }
}
POST test/_doc/1
{
  "message":"hello there I'm testing spaces"
}
GET test/_search
{
  "query": {
	"regexp": {
	  "message.raw": {
		"value": ".*testing .*"
	  }
	}
  }
}