Search a unsearchable field

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

AWS opensearch 2.5.0

Describe the issue:

I have a log with a field named trace that i had set this mapping

    "trace": {
      "type": "text",
      "index": false
    },

In my old elasticsearch setup, i could still search this field via regex query, but in opensearch this is now also shown as unsearchable in the index field list and regex lucent query returns nothing

So 2 questions:

  • how to flag that i want the trace field to be searchable, but not analyzed (for fixing the mapping and future searchs)?
  • how can i search this current data (ie:the already indexed data) ?

this is a rare operation and i would prefer not to index or analyze the trace, as it is full of useless info. That also would only solves the problem for new data, and i need to query data that is already in the ultra-warm. I read that painless could help, but doc[‘trace’].value returns that i need fielddata=true and _source[‘trace’].value returns error

Is the only way right now is exporting the data and use external tools? or to reindex data to another index?

thanks in advance for the help

2

I think that for _source you need to do something like _source.trace. It feels like a syntax error anyway, you should be able to do it.