# Elastic Cloud: Major incident: Elasticsearch 9.5.1: false-positive matches in certain boolean queries

**Summary:** Elastic Cloud reported a major Elasticsearch 9.5.1 issue causing false-positive matches in boolean queries combining multi-value terms in must, filter, or should clauses with must\_not on fields with disabled indexing. It ran from 2026-08-14 09:22 UTC to 2026-08-20 17:09 UTC (6 days 7 h); Elasticsearch 9.5.2 fixes it, and customers on 9.5.0 or 9.5.1 should upgrade. _(machine-written, sol)_
- Kind: Major incident · Label: other (model (Jev))
- Changed: 2026-08-14 09:22 UTC · Detected: 2026-10-17 18:22 UTC
- [Source: https://stspg.io/ljs46l5tgs50](https://stspg.io/ljs46l5tgs50)
- [Company: Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)
- Versions: before (none: first archived) → after incident\_version:276/qcs4jty0rc8d@17480db9f83a
- Change 1 of 1 for this incident

## What changed

**1. Added: Title**

```diff
+ Elasticsearch 9.5.1: false-positive matches in certain boolean queries
```

**2. Added: Impact**

```diff
+ major
```

**3. Added: Status**

```diff
+ resolved
```

**4. Added: Start time**

```diff
+ 2026-08-14 09:22 UTC
```

**5. Added: Resolved time**

```diff
+ 2026-08-20 17:09 UTC
```

**6. Added: Update** (identified) · 2026-08-14 09:22 UTC

```diff
+ Elasticsearch 9.5.1 contains a known issue where boolean queries containing a must, filter, or should clause using a multi-value terms query, alongside a must_not clause on fields with disabled indexing, can still return false-positive matches. While the patch in 9.5.1 (https://github.com/elastic/elasticsearch/pull/155936) resolved the bulk-scorer defect for term and range query paths; multi-value terms queries utilize a different Lucene query type that was not covered by that fix. Time Series Data Streams (TSDB) and columnar indices/data streams remain affected for this query pattern, as indexing is disabled by default on those fields. Affected terms queries may return false-positive matches (including documents that should have been excluded) and report higher document counts than expected. No error is raised, so queries will appear to complete successfully. What you can do: - If you have not yet upgraded to 9.5.*, we recommend deferring the upgrade until version 9.5.2 is available. - If you are already running 9.5.*, contact Elastic Support if you need help determining whether your searches are affected. We have identified the root cause, a fix is in progress, and we are preparing a patch release. We will provide a further update when the fix is ready.
```

**7. Added: Update** (resolved) · 2026-08-20 17:09 UTC

```diff
+ Elasticsearch 9.5.2 has been released and contains the fix for this issue. Customers running 9.5.0 or 9.5.1 should upgrade to 9.5.2. At this time we are considering this issue resolved and will be providing no further updates.
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-08-14 09:22 UTC | Major incident: Elasticsearch 9.5.1: false-positive matches in certain boolean queries (this change) | other |

All Elastic Cloud changes: [timeline](https://rewindex.com/company/elastic-cloud/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/i137ee5bf29b81f · Markdown: https://rewindex.com/change/i137ee5bf29b81f.md · JSON: https://rewindex.com/api/v1/changes/i137ee5bf29b81f · Generated 2026-10-18T02:55:06.875Z