The default_search analyzer overrides the field level analyzer for search

[rSinha-Sfmc]

Elasticsearch version (bin/elasticsearch --version): ES 7.12.1

Plugins installed: []

JVM version (java -version):

OS version (uname -a if on a Unix-like system):

Updated description of the problem including expected versus actual behavior:

analyzer specified on the field was historically used as both search and index analyzer. Something recently changed in such a way that if default index search analyzer is specified it takes over as the field search analyzer. Steps to reproduce:

DELETE test

PUT test
{
  "mappings": {
    "properties": {
      "test": {
        "type": "text",
        "analyzer": "simple"
      }
    }
  },
  "settings": {
    "index": {
      "analysis": {
        "analyzer": {
          "default_search": {
            "filter": [
              "lowercase"
            ],
            "type": "custom",
            "tokenizer": "standard"
          }
        }
      }
    }
  }
}

GET test/_analyze
{
  "text": ["123abc"],
  "field": "test"
}

POST test/_validate/query?explain
{
  "query": {
    "match": {
      "test": "123abc"
    }
  }
}

Original description of the problem including expected versus actual behavior:
Ideally the analyzer used at index time should be used at search unless explicitly altered, this behavior is not followed in ES 7.12.1. At search time standard analyzer is getting selected by default.

Here is the discussion link for this - https://discuss.elastic.co/t/es-7-12-different-analyzers-are-getting-used-for-indexing-and-searching/272186

Steps to reproduce: This discussion has details on how to reproduce this bug https://discuss.elastic.co/t/es-7-12-different-analyzers-are-getting-used-for-indexing-and-searching/272186

The bug only presents itself on version 7.9 and above

Please include a minimal but complete recreation of the problem,
including (e.g.) index creation, mappings, settings, query etc. The easier
you make for us to reproduce it, the more likely that somebody will take the
time to look at it.

This discussion link has complete steps to reproduce the bug - https://discuss.elastic.co/t/es-7-12-different-analyzers-are-getting-used-for-indexing-and-searching/272186
1.
2.
3.

Provide logs (if relevant):

[elasticmachine]

Pinging @elastic/es-search (Team:Search)

[romseygeek]

Thanks for opening this @rSinha-Sfmc - it is indeed a bug. I've opened #73359 to fix it.

[romseygeek]

I should add: you can workaround the bug by specifying the search_analyzer directly in the mapping configuration.

[rSinha-Sfmc]

Our schema is not well defined and some of these fields are dynamically indexed where we don't have control.