I've indexed some data with a field named "observed" that is an object with two other fields named "filename" and "pathname". These fields are analyzed and have multiple values.

The following query executed without problems:

"query_string" : { 
  "fields" : ["observed.filename", "observed.pathname"], 
  "query" : "Autorun", 
  "use_dis_max" : true 
}

but when I change it to the following it fails:

"query_string" : {
  "fields" : ["observed.*"],
  "query" : "Autorun",
  "use_dis_max" : true
}

with the error:

"SearchPhaseExecutionException[Failed to execute phase [query], total failure; shardFailures {[jHW46VKNS_G6Cnrdzko_WA][file_analysis][0]: SearchParseException[[file_analysis][0]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\t"query": {\t "query_string" : {\t "fields" : ["observed."],\t "query" : "Autorun",\t "use_dis_max" : true\t }\t}}]]]; nested: NumberFormatException[For input string: "Autorun"]; }{[jHW46VKNS_G6Cnrdzko_WA][file_analysis][1]: SearchParseException[[file_analysis][1]: from[-1],size[-1]: Parse Failure [Failed to parse source [{\t"query": {\t "query_string" : {\t "fields" : ["observed."],\t "query" : "Autorun",\t "use_dis_max" : true\t }\t}}]]]; nested: NumberFormatException[For input string: "Autorun"]; }]

Why is that? The docs indicate it should work.

Also odd is that the following works:

"query_string" : {
  "fields" : ["observed.f*"],
  "query" : "Autorun",
  "use_dis_max" : true
}

but this fails:

"query_string" : {
  "fields" : ["observed.p*"],
  "query" : "Autorun",
  "use_dis_max" : true
}

I am Running 0.90.0. The mapping for the fields looks like:

"observed" : {
  "type": "object",
  "properties" : {
    "pathname"  : { "type": "string", "analyzer": "path"              },
    "filename"  : {
      "type": "multi_field",
      "fields": {
        "filename": { "type": "string", "analyzer": "path"              },
        "whole"   : { "type": "string", "analyzer": "lowercase_keyword" }
      }
    }
  }
}

There are some other fields in there as well.