bug in query_string : syntax "field:(v1 v2)" does not work anymore on keyword properties

[fbaligand]

Describe the issue:
On Elasticsearch 5.x, in a query_string query, we can use syntax field:(v1 v2 v3) which is the same than field:(v1 OR v2 OR v3)
It does not work anymore with elasticsearch 6.1 on keyword properties : no results returned although field:(v1 OR v2 OR v3) syntax works fine.
It looks like a regression.

Elasticsearch version : 6.1.0 and 6.1.3

JVM version : 1.8.0_131

OS version : Linux RHEL 6

Steps to reproduce:
In Kibana Console :

PUT index1/doc/1
{
"f1": "v1"
}

POST index1/_search
{
  "query": {
    "query_string": {
      "query": "f1.keyword:(v1 v2)"
    }
  }
}

=> returns nothing

POST index1/_search
{
  "query": {
    "query_string": {
      "query": "f1.keyword:(v1 OR v2)"
    }
  }
}

=> returns the doc

POST index1/_search
{
  "query": {
    "query_string": {
      "query": "f1:(v1 v2)"
    }
  }
}

=> returns the doc

[danielmitterdorfer]

Thanks for raising the issue and the reproduction scenario. Can somebody in @elastic/es-search-aggs please have a look at this one?

[jimczi]

This is expected, in 6.x whitespaces are not considered as operators anymore so the query f1:(v1 v2) will pass v1 v2 to the analyzer of the field f1 which then decides how the input should be parsed (for a keyword field it will treat v1 v2 as a single term). If you want to clearly separate v1 and v2 you'll need to add an explicit operator between the terms (AND, OR).
I'll add an example in the docs (and the breaking changes) regarding how we treat whitespaces because the current example is not descriptive enough.

[fbaligand]

Hi @jimczi

OK, so if it is finally a breaking change and so, only a "docs" issue, I think that this doc page especially should be updated (referenced by Kibana search bar) :
https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#query-string-syntax