Custom analyzer doesn't work in mapping but is fine through index/_analyze endpoint, ES v6.8.10

[tehowe]

Why, if I've written an analyzer for Elasticsearch which works when I use the analysis API endpoint, does it not get picked up and used when I set the mapping for a field to that analyzer?

This works:

GET cobalt_strike/_analyze
{
  "text": [
      "gov.domain.org",
      "mfa.gov.domain.org",
      "justice.gov.domain.org"
    ],
  "analyzer": "domain_name_analyzer"
}

This doesn't:

          "host_domains" : {
            "type" : "text",
            "analyzer" : "domain_name_analyzer"
          },

What am I doing wrong? Thanks.

[tehowe]

Ok for future reference (and I wish this was more evident from the documentation), analyzer works in searching ONLY it does not modify the document being stored. So you'll never see a change in Kibana showing the stored tokens and you can't see the tokens created directly other than when using the _analyzer endpoint.