I repeated your steps (without python though) and did not get a hit with the
last query curl (so I guess I was able to reproduce). I then looked at your
mapping definition and found the explicit definition of the _all field a
little strange. You already correctly define the analyzer at the message
field but you do it again at the _all field. I was suspecting that maybe
this leads to the analyzer applied twice (cannot prove this though). Anyway,
removing the mapping for the _all field I got the same hit for both
queries.
However, what still confuses me is that I do not get the same result when
searching for 'teach' instead of 'teaching'. This works on the message field
(this is the point of the snowball stemmer) but it does not give me hits on
the _all field. If I use your original mapping (with the analyzer assigned
to both fields) I get no hits for 'teaching' on _all but I do get a hit for
'teach' on _all.
I maybe doing / testing things wrong but it smells a little buggy around the
_all field.