using the following lucene query in grafana on my new updated 6.0 elasticsearch node:
!exists:"retweeted_status.user.screen_name" AND !exists:"quoted_status.user.screen_name"
This should filter all documents with no "retweeted_status.user.screen_name" and "quoted_status.user.screen_name", unfortunately it reports all documents back (also documents that have these fields not). Also got this issue on kibana.
This is happening since the update to 6.0, has something changed that let this query acting like this?