If I send
{"esQuery":{"query":{"query_string":{"query":"host:\"10.250.11.11\""}}}}
then Kibana/Elastic treats the search as host:\" 10 250 11 11 \".
If I had to guess then the problem lies in Escaping_Special_Characters ie \" will never be unescaped, as Lucene sees \" as it should search for " and not for denoting start/end of a string?
I suppose the problem is that " can mean two different things. Eg.
host:" text with a " inside "
^ ^
| +-- char to search for
+-- start of string
or
host:" text with a " inside "
^ ^
| +-- start of string
+-- char to search for
and Lucene have no way to tell which is which and therefore treats all escaped chars a chars to search for.
A since JSON requires double quotes, all other inner double quotes have to be escaped, and hence Lucene sees them as chars to search for.
Or am I misunderstanding the situation?