We're seeing a situation with one of our indices where documents are being returned during a missing field filter search but then we're seeing those same documents when we search that particular field for a value. How is this possible? We thought that it could be a routing issue but we're unable to prove that as it appears with high certainty that the same document(s) are being returned when we compare our searches. There's about 3,300 docs out of 10,000 that are exhibiting this behavior.
I didn't provide the mapping for this type below but we've got a few different fields we've attempted this on all with the same results... from not_analyzed fields to ones with standard tokenizers.
Here's what we're seeing... if more information is needed, please let me know.
GET myindex/document/1234?routing=ABC123&fields=DocType
{
"_index": "myindex",
"_type": "document",
"_id": "1234",
"_version": 1,
"found": true,
"fields": {"DocType": ["Word"]}
}
GET myindex/document/_search
{
"size": 1,
"fields": ["DocType"],
"filter": {
"missing": {"field": "DocType"}
}
}
"hits": {
"total": 3310,
"max_score": 1,
"hits": [
{
"_index": "myindex",
"_type": "document",
"_id": "1234",
"_score": 1,
"fields": {"DocType": ["Word"]
}
}
]
}
GET myindex/document/_search
{
"fields": ["DocType"],
"query": {
"term": {
"DocType": {"value": "Word"}
}
}
}
"hits": [
{
"_index": "myindex",
"_type": "document",
"_id": "1234",
"_score": 4.0302696,
"fields": {
"DocType": ["Word"]
}
}