Elasticsearch not_analyzed字段无法搜索

Question

美好的一天！

我正在运行elasticsearch 5.0版本。我添加了not_analyzed字段，但它无法搜索。索引是在之前的elasticsearch版本中创建的 - 2.4。

http://es.domain.com:9200/log-2016.11.04/app/_mapping?pretty向我展示了以下内容：

      "app" : {
        "type" : "string",
        "fields" : {
          "keyword" : {
            "type" : "string",
            "index" : "not_analyzed",
            "fielddata" : false
          },
          "raw" : {
            "type" : "string",
            "index" : "not_analyzed",
            "fielddata" : false
          }
        },
        "fielddata" : false
      },

.... skipped ...

      "event" : {
        "type" : "string",
        "fields" : {
          "keyword" : {
            "type" : "string",
            "index" : "not_analyzed",
            "ignore_above" : 256,
            "fielddata" : false
          },
          "raw" : {
            "type" : "string",
            "index" : "not_analyzed",
            "fielddata" : false
          }
        },
        "fielddata" : false
      },

所以，当我尝试通过app.raw（或app.keyword）进行搜索时 - 它会显示结果：

http://es.domain.com:9200/log-2016.11.04/app/_search?q=app.keyword:value1&pretty

    {
  "took" : 356,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 974120,
    "max_score" : 3.0174136,

但是，当我试图通过event.keyword搜索时，它没有显示任何内容：

http://es.domain.com:9200/log-2016.11.04/app/_search?q=event.keyword:value&pretty

结果：

    {
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : [ ]
  }
}

此字段是使用elasticsearch api添加的：

curl -X PUT localhost:9200/log-2016.11.04/app/_mappings -d @field.json

field.json：

{
"properties": {
        "event": {
                "type": "string",
                "fielddata": false,
                "fields": {
                        "keyword": {
                                "type": "string",
                                "index": "not_analyzed",
                                "ignore_above": 256
                        }
                }
        }
}
}

有人可以帮我吗？

谢谢！