Once again thanks for your participation in this. Now that you mentioned I remember why I needed to use query_string. It's because of how I'm constructing the query (a mustache loop):
"query": "{{#ctx.payload.orders_lookup.ordersA}}'{{.}}' {{/ctx.payload.orders_lookup.ordersA}}"
I wanted to use the terms query but there was an issue creating the input for the terms query (string is wrapped in triple quotes due to Kibana’s handling of strings, and the array isn’t parsed correctly).
So I end up updated mapping for OrderId field to create a sub-field of type ’text’ (initially it was only a keyword field) to use with the query string.