Hrm, perhaps you're right. While it's not really clear to me from the query docs, all the examples there explicitly do not include a space after the :, so it's entirely possible that it matters.
Looking at the query being sent to ES, I see the following:
- With \ and no space -
{"query_string":{"query":"my\\ field:*" ... - With \ and space -
{"query_string":{"query":"my\\ field: *" ... - With space in field name -
{"query_string":{"query":"my field:*" ...
So whatever you put in there seems to be sent unaltered to ES as a query_string inside of a bool query. That doesn't really answer your question of which one is right though. Unfortunately, I don't actually know. I'll go find out and post back here though.