Hello,
I have been using query_string in my application which sits behind Swagger APIs and provides rest APIs for our researchers for a few years now. The power of query_string is undeniable. That is why it's the best choice to sit behind an API engine.
However, the absence of excludes feature will turn its greatest power to very dangerous scenarios where I cannot stop users to perform queries on some fields which I don't want them to search nor be able to see. (I can use _source to exclude the fields but still, they can see the rest of the document based on their query)
In all the documentation (all the versions) this is wrong:
GET /_search
{
"query": {
"query_string" : {
"fields" : ["content", "name"],
"query" : "this AND that"
}
}
}
This tells me the fields will be used to query. Which is not true at all where you can simply use the following:
GET /_search
{
"query": {
"query_string" : {
"fields" : ["content", "name"],
"query" : "secretField:TellMeMore!"
}
}
}
This should have been clear in the docs because I used it for 2 years without knowing fields didn't mean just those fields. (I am not talking about security and ACLs, but there are situations where you should have control over what to be searched and what to be retrieved.)
Can we please have this feature in query_string where we can simply use excludes to list some fields which should not be used in search? (I don't want to use mapping to make them not searchable, other APIs have the right to use those fields to search. I just want to be able to control my query.)
Many thanks for your time 
PS:
This question was raised 2 years ago, and the response that the user should come up with his own parser was not fair. Elasticsearch should first clarify the fields doesn't mean only those fields will be searchable. Also, it is only logical that this is much easier, cleaner, and more stable where Elasticsearch at its core ignore a list of fields rather than a user writes its own parser.
