Hi! How old is the ES version? I'm going to say at least 6.0 because that's when merge behavior changed. In versions of ES earlier than 6.0, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead. Disable merge was introduced in 6.2.0.
The problem we have arises when people leave the company and come back later, which happens regularly, especially for contractors. Even if they are given a brand new account and brand new employee number, as they should, if they have the same email address identitymerge will merge the two entries. So suddenly we have employees who exist but splunk thinks they have an endDate in the past.
And we want to keep the old entry in identities, as it's useful to check activity from expired accounts or when investigating old events.
Splunk didn't think this through obviously. I worked around this issue by massaging the data before ES ingests it.