Elastic search tokenizing my query string, an email address. How to stop it?

Question

My type is user: email and username.

The email field is set to type string, with a custom analyzer 'exact_lower':

index.analysis.analyzer.exact_lower:
  type: custom
  tokenizer: keyword
  filter : lowercase

The problem is when I search for a full email address it is returning matches as if the '@' was a space. I assume due to it tokenizing the search.

Query I'm sending in:

{
  "query" : {
    "query_string" : {
      "query" : "[email protected]"
    }
  }
}

It is returning anything matching 'admin' or 'example.com'. E.g. [email protected], [email protected], and [email protected]. I want it to only return [email protected]...

I think I need to tell the search not to tokenize the query_string, but haven't been able to figure out how to do that.

Any help is much appreciated! Thanks, Seth

Andrei Stefan Andrei Stefan · Accepted Answer · 2015-10-19T22:14:55

That's like that because query_string is using the _all field as the default field to search on. And that field has its own analyzer.

Defining an analyzer for your email field is not applying the same analyzer to the _all field. More details about _all you can find here.

To match exactly the email address I suggest a different query:

{
  "query": {
    "term": {
      "email": {
        "value": "[email protected]"
      }
    }
  }
}

or using query_string, but referring to a specific field:

{
  "query": {
    "query_string": {
      "query": "email:[email protected]"
    }
  }
}