# Defining custom analyzer that understands URLS/hostnames/emails and can exclude patterns

**URL:** <https://discuss.elastic.co/t/defining-custom-analyzer-that-understands-urls-hostnames-emails-and-can-exclude-patterns/11163>\
**Category:** Elasticsearch\
**Created:** [March 14, 2013, 9:37pm UTC](https://discuss.elastic.co/t/defining-custom-analyzer-that-understands-urls-hostnames-emails-and-can-exclude-patterns/11163 "2013-03-14T21:37:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shadyabhi](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@shadyabhi](https://discuss.elastic.co/u/shadyabhi)\
**Post date:** [March 14, 2013, 9:37pm UTC](https://discuss.elastic.co/t/defining-custom-analyzer-that-understands-urls-hostnames-emails-and-can-exclude-patterns/11163/1 "2013-03-14T21:37:31Z")

</div>

Hi,

For ex, if I have a message line like:

> Mar 14 20:22:41 subdomain.mydomain.colo postfix/smtpd[16862]: NOQUEUE:  
> reject: RCPT from unknown[1.2.3.4]: 450 4.7.1 Client host rejected:  
> cannot find your reverse hostname, [5.6.7.8]; from=[erp@misms.net.in](mailto:erp@misms.net.in)  
> to=[a@domain1.com](mailto:a@domain1.com) proto=ESMTP helo=\<[a.domain.net](http://a.domain.net)\> also  
> from=\<\>

The standard tokenizer tokenizes emailaddresses and hostnames (if they  
contain "-" in the hostnames). I would like to have emailaddress and  
hostnames to not be tokenized. One way I could see that being possible was  
using char\_filter and replacing "-" with "\_" so that it's not tokenized.  
It's a way but isn't there a better way without replacing hypens? I also  
saw uax\_url\_email filter which might be of help.

Also, I would like to exclude few words (for ex, "from=\<\>") from  
tokenizing, I could see that being possible by using word\_delimiter.

Can anyone please help me with all this together the right way? One more  
thing, is it possible to apply both standard and whitespace analyzers on a  
field?

--  
Regards,  
Abhijeet Rastogi (shadyabhi)

> **[New community features for Google Chat and an update on Currents](https://workspaceupdates.googleblog.com/2023/04/new-community-features-for-google-chat-and-an-update-currents%20.html)**
>
> Note:  This blog post outlines upcoming changes to Google Currents for Workspace users. For information on the previous deprecation of Googl...

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:46am UTC](https://discuss.elastic.co/t/defining-custom-analyzer-that-understands-urls-hostnames-emails-and-can-exclude-patterns/11163/2 "2017-07-06T02:46:20Z")

</div>


