By default, wildcard terms are lowercased. Because your short_message field is not_analyzed, a wildcard query with an uppercase I will not match any results (Elasticsearch will search for a lowercase i and not find internal with a lowercase i). Setting lowercase_expanded_terms to false in Kibana's query:queryString:options under Advanced Settings will resolve this.
You also need to change the default value of analyze_wildcard to false for the same reason.
The resulting value for the query:queryString:options setting in Kibana will look like this: { "analyze_wildcard": false, "lowercase_expanded_terms": false}
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.