Elasticsearch Version

main

Installed Plugins

No response

Java Version

bundled

OS Version

all

Problem Description

Multi-field keywords with path characters now seem to require additional escaping breaking some downstream products which I believe may have been an unintended outcome of the changes in: #129169

Steps to Reproduce

Here's what I've done to replicate. Spin up 8.18.6 and 8.19.0 separately. Then do the following:

create a mapping

curl -XPUT --header 'Content-Type: application/json' "http://localhost:9200/test" -d '{
  "mappings": {
    "properties": {
      "path": {
          "type": "keyword",
          "fields": {
            "caseless": {
              "type": "keyword"
            }
         }
      }
    }
  }
}'

index a doc

seq 1 1 | xargs -I % -P1 curl -XPOST --header 'Content-Type: application/json' "http://localhost:9200/test/_doc?refresh" -d '
    { "path": "c:\\windows\\system32\\svchost.exe" }
'

attempt to query the doc:

curl -XGET --header 'Content-Type: application/json' "http://localhost:9200/test/_search" -d '{
  "query" : {
    "term": {
      "path.caseless": {
        "value": "c:\\windows\\system32\\svchost.exe"
      }
    }
  }
}' | python -mjson.tool

The query only works in 8.16.3 and otherwise the queried path.caseless must be escaped in 8.19.0 as c:\\\\windows\\\\system32\\\\svchost.exe wherein the query will complete successfully. This only happens in a multi-field scenario. The top level path keyword seems un-impacted by the change in 8.19.0.

This also appears to be broken on main as well.

Logs (if relevant)

No response