ES index mapping has "query" parameter

Question

One of my indices had this mapping:

"mappings": {
            "properties": {
                "count": {
                    "type": "integer"
                },
                "currency": {
                    "type": "text",
                    "fields": {
                        "keyword": {
                            "type": "keyword",
                            "ignore_above": 16
                        }
                    }
                },
                "query": {
                    "properties": {
                        "match_all": {
                            "type": "object"
                        },
                        "range": {
                            "properties": {
                                "hour": {
                                    "properties": {
                                        "gte": {
                                            "type": "date"
                                        },
                                        "lt": {
                                            "type": "date"
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }

I couldn't understand why was it so I created a new index and made sure it didn't have this query fluff in it. After ensuring that the new index's mapping was fine, I started the reindex process, but after some time, I again noticed this:

"mappings": {
            "properties": {
                "count": {
                    "type": "integer"
                },
                "currency": {
                    "type": "keyword",
                    "index_options": "freqs"
                },
                "query": {
                    "properties": {
                        "match_all": {
                            "type": "object"
                        }
                    }
                }
            }
        }

The query part is changed, but it's still there and I am not sure what's causing it to be like this

Answer 1

When you don't set "dynamic": "strict" in your mapping, your mapping will be allowed to be spread by indexing new data. You have inserted the query section as data to your index. When you reindex data, all data will be transferred to the new index and you still see that post and changing mapping. To not have this, you need to set "dynamic": "strict" in your mapping or try not to index such documents.

Answer 2

This is usually the result of posting the query to an endpoint different than the _search endpoint.

For instance, if you run this, you're going to create a new document and modify the mapping of your index

POST index/_doc
{
  "query": {
    "match_all": {}
  }
}

Queries must always be sent to the _search endpoint:

POST index/_search
{
  "query": {
    "match_all": {}
  }
}