Incorrect or incomplete results when using knife search

https://docs.chef.io/workstation/knife_search/#nested-fields

Please pay special attention to this paragraph:

A nested field appears deeper in the JSON data structure. For example, information about a network interface might be several layers deep: node[:network][:interfaces][:en1]. When nested fields are present in a JSON structure, the chef-client will extract those nested fields to the top-level, flattening them into compound fields that support wildcard search patterns.

This means that if you have "anything:platform:windows" anywhere in your node data on any node in the same organization and environment and you search like this, you will get back every node that has that "platform:windows" key, no matter how many levels deep it is in the node data hierarchy and whether or not the system is actually a windows system. This surfacing of deeply nested attributes is a convenience, but can interfere if you are expecting something more simplistic.

knife search node 'platform:windows'

You can fix this by avoiding keywords found by default in an unmodified node data object, like "platform:windows", "name:whatever", and so on. Let's say you would like for one node to have a list of other node's names. A good choice in this case would be to add those entries with the key "peer_name:" maybe. Anything but "name:" or some other keyword already used by Chef's ohai attributes found under the "automatic:" top level key or any other top level key.

As a clear example of such a data-driven search mishap, watch this. I can confirm that this system is actually a centos platform system.

$ knife node show test-start.lxc
Node Name: test-start.lxc
Policy Name: testpolicy
Policy Group: test-start-systems
FQDN: test-start.lxc
IP:
Run List: 
Recipes: 
Platform: centos 7.3.1611
Tags:

Then, I adjust this system's node data like this, where I add a new default level nested attribute that includes the key:value "platform:windows"

EDITOR=vi knife node edit test-start.lxc -a

 "default": {
   "sean": {
     "bad": {
       "platform": "windows"
     }
   },

...other stuff...
}

Then, I do a search for windows platform systems and find one system, THE SAME SYSTEM! Well, that's bad, because the system hasn't changed platforms, it is still centos. I don't have any windows platform systems in this chef server organization

# knife search "platform:windows"
1 items found

Node Name: test-start.lxc
Policy Name: testpolicy
Policy Group: test-start-systems
FQDN: test-start.lxc
IP:
Run List: 
Recipes: 
Platform: centos 7.3.1611
Tags: 

If I remove the new entry, we're back to normal.

EDITOR=vi knife node edit test-start.lxc -a
Saving updated default on node test-start.lxc

# knife search "platform:windows"
0 items found