Elasticsearch Query String Query with @ symbol and wildcards

2
votes

I defined a custom analyzer that I was surprised not built-in.

analyzer": {
    "keyword_lowercase": {
        "type": "custom",
        "filter": [
            "lowercase"
        ],
        "tokenizer": "keyword"
    }
}

Then my mapping for this field is:

"email": {
    "type": "string",
    "analyzer": "keyword_lowercase"
}

This works great. (http://.../_analyze?field=email&[email protected]) ->

"tokens": [
    {
        "token": "[email protected]",
        "start_offset": 0,
        "end_offset": 16,
        "type": "word",
        "position": 1
    }
]

Finding by that keyword works great. http://.../[email protected] yields results.

The problem is trying to incorporate wildcards anywhere in the Query String Query. http://.../_search?q=*[email protected] yields no results. I would expect results containing emails such as "[email protected]" and "[email protected]".

It looks like elasticsearch performs the search with the default analyzer, which doesn't make sense. Shouldn't it perform the search with each field's own default analyzer?

I.E. http://.../_search?q=email:*[email protected] returns results because I am telling it which analyzer to use based upon the field.

Can elasticsearch not do this?

1
elasticsearchlucene
Can you post your query that uses query_string? It may be that you're not telling elasticsearch which field to search - if so it will use the _all field, which is an automatically generated combination of all the fields and uses the standard analyser. - Olly Cruickshank
the _search?q= is a query string query. See elasticsearch.org/guide/en/elasticsearch/reference/current/… Yes, it uses _all. So, from what you said, it is as I figured. It uses the standard analyzer for all fields, not the each field's default analyzer. - dwieeb
to add on wildcard queries are not analyzed as a result they do not match in the _all field. - keety
Ooh, I need to use the full query search query (elasticsearch.org/guide/en/elasticsearch/reference/current/…) and set analyze_wildcard to true. This fixes my issue. - dwieeb

1 Answers