I'm playing with building some Kibana dashboards and I noticed a peculiar behavior - when I try to filter documents by very simple prefix queries involving one string field (i.e. field:value*) some fields can be queried this way, others return no results.
All queries work if I try to filter by an actual full field value, i.e. field1:value or field2:somestring
For some fields I get the expected results when I run a prefix query, i.e. field1:val*
For other fields I get nothing, i.e. field2:some* returns no results even as field2:something returns results
The frustrating part is that I haven't been able to figure out what the difference is between the those fields that makes them behave differently. All fields are strings, they are not analyzed and the _all field is disabled. Prefix queries with similar intent using the Elasticsearch query language on the source data always work as expected.