Elasticsearch _all_ field POC enabling, excluding field and not_analysed fields

add_docs.es

PUT /t/t/1
{
  "one": "One ONE",
  "two": "Two TWO"
}

Elasticsearch_all_field_include_all_poc.es

//  lets create our index
PUT /t
{
  "mappings": {
    "t": {
      "_all": {
        "enabled": true
      }, 
      "properties": {
        "one": {
          "type": "string",
            "index": "not_analyzed",
            "include_in_all": false
        },
        "two": {
          "type": "string",
          "index": "not_analyzed"
        }
      }
    }
  }
}

search_docs.es

//  should return 0 docs, mapping is set to not not_analyse
GET /t/_search
{
  "query": {
    "match": {
      "two": "four"
    }
  }
}

// should return 1 docs matching doc, we are searching for full exact phrase. Caps sensitive! 
GET /t/_search
{
  "query": {
    "match": {
      "two": "Four FOUR"
    }
  }
}

// should return docs with search phrase "two" or "four", as by default `include_in_all: true` for the field `two` as we have not set it
// but not "one" and "three" because we explicitly say `include_in_all: false` in field `one`
GET /t/_search
{
  "query": {
    "match": {
      "_all": "three"
    }
  }
}

//  `_all` field should only contain tokens from the field `two`
GET /t/_search
{
  "size": 0, 
  "aggs": {
    "terms_in_all_field": {
      "terms": {
        "field": "_all"
      }
    }
  }
}