Elasticsearch Version

main

Installed Plugins

none

Java Version

bundled

OS Version

Linux anduril 6.8.0-60-generic #63~22.04.1-Ubuntu

Problem Description

If an index has synthetic source and a flattened field, the source will be reconstructed from key/value doc_values. Where the keys are the flattened paths with a . character between each key in the path. If two paths share the same leaf name, and the paths are adjacent when all paths are sorted, the value for the first path will be attributed to the second path, and put in that object.

Steps to Reproduce

PUT my-index { "settings": { "mode": "logsdb" }, "mappings": { "properties": { "test": { "type": "flattened" } } } } POST my-index/_doc { "@timestamp": "2025", "test": { "a.x": 123, "b.x": 456 } } GET my-index/_search Returns: "test": { "a": {}, "b": { "x": [ "10", "20" ] } } 

The value for a.x was added to b.x incorrectly. So a is empty, and b.x is an array with two values.

Logs (if relevant)

No response