Elastic has identified a major issue in Elasticsearch 9.5.1 where boolean queries containing must, filter, or should clauses with multi-value terms queries—paired with must_not clauses on fields with disabled indexing—can return false-positive matches. Affected queries may include documents that should have been excluded and report higher document counts than expected. No error is raised, so queries appear to complete successfully.
Elasticsearch is a widely-used open-source search and analytics engine relied upon by enterprises for log analysis, full-text search, and time-series data indexing.
The root cause has been identified. A patch in 9.5.1 addressed a bulk-scorer defect for term and range queries, but multi-value terms queries use a different Lucene query type not covered by that fix. Time Series Data Streams and columnar indices remain affected. Elastic recommends deferring upgrades to 9.5.* until version 9.5.2 becomes available; users already running 9.5.* should contact support to determine whether their searches are impacted. A patch release is in preparation.
This story is developing and will be updated as new information becomes available.