# Escape character for '@' '-' in query string?

**URL:** <https://discuss.elastic.co/t/escape-character-for-in-query-string/365844>\
**Category:** Elastic Search\
**Created:** [August 30, 2024, 9:45pm UTC](https://discuss.elastic.co/t/escape-character-for-in-query-string/365844 "2024-08-30T21:45:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chaplin\_Huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chaplin_huang/32/137186_2.png) [@Chaplin\_Huang](https://discuss.elastic.co/u/Chaplin_Huang)\
**Post date:** [August 30, 2024, 9:45pm UTC](https://discuss.elastic.co/t/escape-character-for-in-query-string/365844/1 "2024-08-30T21:45:50Z")

</div>

Hi Elastic community! I am currently developing [tagger analyzer rules](https://github.com/google/timesketch/blob/a89ef9fb65066ff36f110fe21459fd28e1571a7c/data/tags.yaml) for timesketch. For the rules I am supposed to use [query\_string](https://github.com/google/timesketch/blob/a89ef9fb65066ff36f110fe21459fd28e1571a7c/data/tags.yaml#L14), which is a mini language of Query string. I was trying to check something that contains '@hotmail.com', but I wasn't able to get any hits. The things I have tried are the below but none of them worked. Does anyone know how escape character for '@' or '-' work?

```auto
query_string: '_exists_:email AND NOT email:*@hotmail.com*'

query_string: '_exists_:email AND NOT email:*\@hotmail.com*'

query_string: '_exists_:email AND NOT email:*\\@hotmail.com*'

```

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![RabBit\_BR](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rabbit_br/32/82261_2.png) [@RabBit\_BR](https://discuss.elastic.co/u/RabBit_BR)\
**Post date:** [September 2, 2024, 11:34pm UTC](https://discuss.elastic.co/t/escape-character-for-in-query-string/365844/2 "2024-09-02T23:34:32Z")

</div>

Hi @Chaplin_Huang

When you index a document with a "text" field, Elasticsearch applies the text analyzer process, which by default includes tokenization and conversion to lowercase.

The "text" field is processed by the default analyzer, which breaks the text into tokens based on spaces and punctuation marks. For example, `xpto@hotmail.com` can be broken into tokens like "xpto" and "[hotmail.com](http://hotmail.com)".

When you use query\_string with wildcards, Elasticsearch does not apply the same analyzing process to the query that was applied to the field during indexing. In this case, `*@hotmail.com*` does not exactly match any of the tokens that were indexed.

If you need to perform exact searches like this, consider storing the email in a keyword field. That way, the field value will be stored exactly as provided, without analizer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 30, 2024, 11:35pm UTC](https://discuss.elastic.co/t/escape-character-for-in-query-string/365844/3 "2024-09-30T23:35:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.