Behavior Change Introduced by Optimizing How Escape Sequences Are Handled #134770
Description
Elasticsearch Version
main
Installed Plugins
No response
Java Version
bundled
OS Version
all
Problem Description
Multi-field keywords with path characters now seem to require additional escaping breaking some downstream products which I believe may have been an unintended outcome of the changes in: #129169
Steps to Reproduce
Here's what I've done to replicate. Spin up 8.18.6 and 8.19.0 separately. Then do the following:
create a mapping
curl -XPUT --header 'Content-Type: application/json' "http://localhost:9200/test" -d '{
"mappings": {
"properties": {
"path": {
"type": "keyword",
"fields": {
"caseless": {
"type": "keyword"
}
}
}
}
}
}'
index a doc
seq 1 1 | xargs -I % -P1 curl -XPOST --header 'Content-Type: application/json' "http://localhost:9200/test/_doc?refresh" -d '
{ "path": "c:\\windows\\system32\\svchost.exe" }
'
attempt to query the doc:
curl -XGET --header 'Content-Type: application/json' "http://localhost:9200/test/_search" -d '{
"query" : {
"term": {
"path.caseless": {
"value": "c:\\windows\\system32\\svchost.exe"
}
}
}
}' | python -mjson.tool
The query only works in 8.16.3 and otherwise the queried path.caseless must be escaped in 8.19.0 as c:\\\\windows\\\\system32\\\\svchost.exe wherein the query will complete successfully. This only happens in a multi-field scenario. The top level path keyword seems un-impacted by the change in 8.19.0.
This also appears to be broken on main as well.
Logs (if relevant)
No response