# Confused on Analyzer and Query String Query

**URL:** <https://discuss.elastic.co/t/confused-on-analyzer-and-query-string-query/18756>\
**Category:** Elasticsearch\
**Created:** [July 21, 2014, 5:09am UTC](https://discuss.elastic.co/t/confused-on-analyzer-and-query-string-query/18756 "2014-07-21T05:09:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Curt\_Hu](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@Curt\_Hu](https://discuss.elastic.co/u/Curt_Hu)\
**Post date:** [July 21, 2014, 5:09am UTC](https://discuss.elastic.co/t/confused-on-analyzer-and-query-string-query/18756/1 "2014-07-21T05:09:03Z")

</div>

I think I have posted something related with this before. But I still got confused on how analyzer and query\_string query works.

I have an index with several million records, and I think all the fields are using the standard analyzer.

Q1. What is the exactly command to get my ES system level default analyzer, index default analyzer, or specific field analyzer??

Well, I think it's common since I've tried the following:  
curl -XGET 'balbalbla/index\_name/\_analyze?[text=www.google.com](http://text=www.google.com)'  
I got the result is:  
{"tokens":[{"token":"[www.google.com](http://www.google.com)","start\_offset":0,"end\_offset":14,"type":"","position":1}]}  
This means, "index\_name"'s analyzer treats "[www.google.com](http://www.google.com)" as a single token. Please correct me if it's wrong.

So, this index has a field called "url" which is something like "[www.google.com](http://www.google.com)", "[www.facebook.com](http://www.facebook.com)"...  
I am trying to use query\_string query to fetch something:

If I am doing:  
"query\_string": {  
"default\_field": "url",  
"analyzer": "whitespace", // or "analyzer" : "standard"  
"query": "ipo.loyal3"  
}

I got 2 hits, good, the field url of 2 hits are both "[ipo.loyal3.com](http://ipo.loyal3.com)", and no matter the "whitespace" analyzer or "standard" analyzer I choose above.

But If I change the "query" to "[ipo.loyal3.com](http://ipo.loyal3.com)" and try again. Here are the results I got the following results which I can not understand:

choose "standard" analyzer: I got around 200k hits, but only the top 2 hits are the real one "[ip.loyal3.com](http://ip.loyal3.com)"  
choose "whitespace" analyzer: the query return very quickly with 0 hits.

I can not really understand this behavior, is the problem here related with ".com" here, or analyzer, or something special to query\_string query?

Thanks very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:14am UTC](https://discuss.elastic.co/t/confused-on-analyzer-and-query-string-query/18756/2 "2017-07-06T01:14:38Z")

</div>