https://docs.chef.io/workstation/knife_search/#nested-fields
Please pay special attention to this paragraph:
A nested field appears deeper in the JSON data structure. For example, information about a network interface might be several layers deep: node[:network][:interfaces][:en1]. When nested fields are present in a JSON structure, the chef-client will extract those nested fields to the top-level, flattening them into compound fields that support wildcard search patterns.
This means that if you have "anything:platform:windows" anywhere in your node data on any node in the same organization and environment and you search like this, you will get back every node that has that "platform:windows" key, no matter how many levels deep it is in the node data hierarchy and whether or not the system is actually a windows system. This surfacing of deeply nested attributes is a convenience, but can interfere if you are expecting something more simplistic.
knife search node 'platform:windows'
You can fix this by avoiding keywords found by default in an unmodified node data object, like "platform:windows", "name:whatever", and so on. Let's say you would like for one node to have a list of other node's names. A good choice in this case would be to add those entries with the key "peer_name:" maybe. Anything but "name:" or some other keyword already used by Chef's ohai attributes found under the "automatic:" top level key or any other top level key.
As a clear example of such a data-driven search mishap, watch this. I can confirm that this system is actually a centos platform system.
$ knife node show test-start.lxc
Node Name: test-start.lxc
Policy Name: testpolicy
Policy Group: test-start-systems
FQDN: test-start.lxc
IP:
Run List:
Recipes:
Platform: centos 7.3.1611
Tags:
Then, I adjust this system's node data like this, where I add a new default level nested attribute that includes the key:value "platform:windows"
EDITOR=vi knife node edit test-start.lxc -a
"default": {
"sean": {
"bad": {
"platform": "windows"
}
},
...other stuff...
}
Then, I do a search for windows platform systems and find one system, THE SAME SYSTEM! Well, that's bad, because the system hasn't changed platforms, it is still centos. I don't have any windows platform systems in this chef server organization
# knife search "platform:windows"
1 items found
Node Name: test-start.lxc
Policy Name: testpolicy
Policy Group: test-start-systems
FQDN: test-start.lxc
IP:
Run List:
Recipes:
Platform: centos 7.3.1611
Tags:
If I remove the new entry, we're back to normal.
EDITOR=vi knife node edit test-start.lxc -a
Saving updated default on node test-start.lxc
# knife search "platform:windows"
0 items found