# Elasticsearch find "%40" in email text field

**URL:** <https://discuss.elastic.co/t/elasticsearch-find-40-in-email-text-field/204064>\
**Category:** Elasticsearch\
**Created:** [October 17, 2019, 1:18pm UTC](https://discuss.elastic.co/t/elasticsearch-find-40-in-email-text-field/204064 "2019-10-17T13:18:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![christof](https://avatars.discourse-cdn.com/v4/letter/c/3da27b/32.png) [@christof](https://discuss.elastic.co/u/christof)\
**Post date:** [October 17, 2019, 1:18pm UTC](https://discuss.elastic.co/t/elasticsearch-find-40-in-email-text-field/204064/1 "2019-10-17T13:18:11Z")

</div>

Hi,

I have several emails in our es that have `%40` instead of the `@` in them (e.g. john%[40test.com](http://40test.com)). I'm trying to search directly for them using the regex search function, but am having issues in identifying for these cases. I've tried searching for both `%40` and `\u0025`, but both of these haven't produced any hits. The following is the general search query I've using:

`ES.search( "db", body={"query": {"regexp": {"emails": {"value": "\u0025"}}}})`

Any help would be much appreciated,  
Thanks,  
Chris

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 22, 2019, 8:38am UTC](https://discuss.elastic.co/t/elasticsearch-find-40-in-email-text-field/204064/2 "2019-10-22T08:38:38Z")

</div>

Hey,

this question cannot be answered with some more insight into your setup of the mapping of the field that stores the email address. By default it's like the following

```auto
GET _analyze
{
  "text": "john%40test.com"
}

# response
{
  "tokens" : [
    {
      "token" : "john",
      "start_offset" : 0,
      "end_offset" : 4,
      "type" : "<ALPHANUM>",
      "position" : 0
    },
    {
      "token" : "40test.com",
      "start_offset" : 5,
      "end_offset" : 15,
      "type" : "<ALPHANUM>",
      "position" : 1
    }
  ]
}

```

This means the percent sign is removed as part of analysis, making it really hard to impossible to search for it... If speed is not an issue, you could use a [script filter](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/query-dsl-script-filter.html) or search the keyword field, but you should still fix the mapping.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2019, 8:38am UTC](https://discuss.elastic.co/t/elasticsearch-find-40-in-email-text-field/204064/3 "2019-11-19T08:38:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.