# Find e-mail

**URL:** <https://discuss.elastic.co/t/find-e-mail/6376>\
**Category:** Elasticsearch\
**Created:** [January 13, 2012, 8:13pm UTC](https://discuss.elastic.co/t/find-e-mail/6376 "2012-01-13T20:13:54Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hugo](https://avatars.discourse-cdn.com/v4/letter/h/b38774/32.png) [@Hugo](https://discuss.elastic.co/u/Hugo)\
**Post date:** [January 13, 2012, 8:13pm UTC](https://discuss.elastic.co/t/find-e-mail/6376/1 "2012-01-13T20:13:54Z")

</div>

Hi all,

Can anyone please help me on this issue? I'm trying to find an e-mail  
with elasticsearch but can't seem to get it to work properly.

I've created an index with the following mapping:

$ curl -s -XPUT [http://localhost:9200/users/info/\_mapping](http://localhost:9200/users/info/_mapping) -d '  
{  
"info" : {  
"properties": {  
"name" : {  
"type": "multi\_field",  
"fields" : {  
"name": {  
"type" : "string"  
},  
"untouched" : {  
"type": "string",  
"index" : "not\_analyzed"  
}  
}  
},  
"email" : {"type" : "string", "analyzer":"keyword"}  
}  
}  
}'

Add two documents:

$ curl -XPUT [http://localhost:9200/users/info/1](http://localhost:9200/users/info/1) -d '{  
"user": "user1",  
"email": "user1@email.com",  
"message": "Testing"  
}'

$ curl -XPUT [http://localhost:9200/users/info/2](http://localhost:9200/users/info/2) -d '{  
"user": "user2",  
"email": "user2@email.com",  
"message": "Programming"  
}'

Note: I set the email analyzer to "keyword" because in the  
presentation [http://www.slideshare.net/clintongormley/terms-of-endearment-the-elasticsearch-query-dsl-explained](http://www.slideshare.net/clintongormley/terms-of-endearment-the-elasticsearch-query-dsl-explained)  
it is showed that the email is set as a token with this analyzer.

And then I've created the following query:

$ curl -XGET '[http://localhost:9200/users/info/\_search?pretty=1](http://localhost:9200/users/info/_search?pretty=1)' -d '  
{  
"query" : {  
"filtered" : {  
"query" : { "match\_all" : {} },  
"filter" : {  
"and" : [  
{ "term" : { "\_all" : "user1@email.com" } },  
{ "not": { "filter" : { "ids" : { "values" :  
["400"] } } } }  
]  
}  
}  
}  
}'

But it doesn't work. The result is empty.

I've checked that this query work if I one another field (the name for  
instance):

$ curl -XGET '[http://localhost:9200/users/info/\_search?pretty=1](http://localhost:9200/users/info/_search?pretty=1)' -d '  
{  
"query" : {  
"filtered" : {  
"query" : { "match\_all" : {} },  
"filter" : {  
"and" : [  
{ "term" : { "\_all" : "user1" } },  
{ "not": { "filter" : { "ids" : { "values" :  
["400"] } } } }  
]  
}  
}  
}  
}'

It also works if I try to find only in the field "name":

curl -XGET '[http://localhost:9200/users/info/\_search?pretty=1](http://localhost:9200/users/info/_search?pretty=1)' -d '  
{  
"query" : {  
"filtered" : {  
"query" : { "match\_all" : {} },  
"filter" : {  
"and" : [  
{ "term" : { "email" : "user1@email.com" } },  
{ "not": { "filter" : { "ids" : { "values" :  
["400"] } } } }  
]  
}  
}  
}  
}'

Thanks for your help.  
Best regards,  
Hugo

---

<div class="post-metadata">

**Author:** ![Clinton\_Gormley](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)\
**Post date:** [January 14, 2012, 9:43am UTC](https://discuss.elastic.co/t/find-e-mail/6376/2 "2012-01-14T09:43:28Z")

</div>

Hiya

> I've created an index with the following mapping:

> ```
> "email" : {"type" : "string", "analyzer":"keyword"}
> 
> ```

> And then I've created the following query:
> 
> $ curl -XGET '[http://localhost:9200/users/info/\_search?pretty=1](http://localhost:9200/users/info/_search?pretty=1)' -d '

> ```
> { "term" : { "_all" : "user1@email.com" } },
> 
> ```

You have set the 'email' field to use they keyword analyzer, but then  
you are querying the \_all field, which uses the standard analyzer by  
default.

So your email address is not stored in \_all as the single term  
"[user1@email.com](mailto:user1@email.com)".

Try this clause instead:

```
      { "term" : { "email" : "user1@email.com" } },

```

clint

---

<div class="post-metadata">

**Author:** ![Hugo](https://avatars.discourse-cdn.com/v4/letter/h/b38774/32.png) [@Hugo](https://discuss.elastic.co/u/Hugo)\
**Post date:** [January 14, 2012, 3:12pm UTC](https://discuss.elastic.co/t/find-e-mail/6376/3 "2012-01-14T15:12:50Z")

</div>

Hi Clinton,  
Thanks for the help.  
Is it possible to change the behaviour of \_all so it finds the emails  
also?

Thanks again.

Best regards,  
Hugo

On 14 Jan, 09:43, Clinton Gormley [cl...@traveljury.com](mailto:cl...@traveljury.com) wrote:

> Hiya
> 
> > I've created an index with the following mapping:  
> > "email" : {"type" : "string", "analyzer":"keyword"}  
> > And then I've created the following query:
> 
> > $ curl -XGET '[http://localhost:9200/users/info/\_search?pretty=1](http://localhost:9200/users/info/_search?pretty=1)' -d '  
> > { "term" : { "\_all" : "[us...@email.com](mailto:us...@email.com)" } },
> 
> You have set the 'email' field to use they keyword analyzer, but then  
> you are querying the \_all field, which uses the standard analyzer by  
> default.
> 
> So your email address is not stored in \_all as the single term  
> "[us...@email.com](mailto:us...@email.com)".
> 
> Try this clause instead:
> 
> ```
> { "term" : { "email" : "us...@email.com" } },
> 
> ```
> 
> clint

---

<div class="post-metadata">

**Author:** ![Clinton\_Gormley](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)\
**Post date:** [January 14, 2012, 3:23pm UTC](https://discuss.elastic.co/t/find-e-mail/6376/4 "2012-01-14T15:23:45Z")

</div>

On Sat, 2012-01-14 at 07:12 -0800, Hugo wrote:

> Hi Clinton,  
> Thanks for the help.  
> Is it possible to change the behaviour of \_all so it finds the emails  
> also?

Hi Hugo,

you could change the analyzer that \_all uses to the uax\_url\_email  
analyzer, which is the same as the standard analyzer except that it  
keeps email addresses and urls as single tokens

clint

> Thanks again.
> 
> Best regards,  
> Hugo
> 
> On 14 Jan, 09:43, Clinton Gormley [cl...@traveljury.com](mailto:cl...@traveljury.com) wrote:
> 
> > Hiya
> > 
> > > I've created an index with the following mapping:  
> > > "email" : {"type" : "string", "analyzer":"keyword"}  
> > > And then I've created the following query:
> > 
> > > $ curl -XGET '[http://localhost:9200/users/info/\_search?pretty=1](http://localhost:9200/users/info/_search?pretty=1)' -d '  
> > > { "term" : { "\_all" : "[us...@email.com](mailto:us...@email.com)" } },
> > 
> > You have set the 'email' field to use they keyword analyzer, but then  
> > you are querying the \_all field, which uses the standard analyzer by  
> > default.
> > 
> > So your email address is not stored in \_all as the single term  
> > "[us...@email.com](mailto:us...@email.com)".
> > 
> > Try this clause instead:
> > 
> > ```
> > { "term" : { "email" : "us...@email.com" } },
> > 
> > ```
> > 
> > clint

---

<div class="post-metadata">

**Author:** ![Hugo](https://avatars.discourse-cdn.com/v4/letter/h/b38774/32.png) [@Hugo](https://discuss.elastic.co/u/Hugo)\
**Post date:** [January 14, 2012, 7:38pm UTC](https://discuss.elastic.co/t/find-e-mail/6376/5 "2012-01-14T19:38:48Z")

</div>

Hi again Clinton,

Thanks for your help.  
Can you please tell me how to do that?

I've tried to do:

curl -s -XPUT [http://localhost:9200/users/info/\_mapping](http://localhost:9200/users/info/_mapping) -d '  
{  
"info" : {  
"properties": {  
"name" : {  
"type": "multi\_field",  
"fields" : {  
"name": {  
"type" : "string"  
},  
"untouched" : {  
"type": "string",  
"index" : "not\_analyzed"  
}  
}  
},  
"email" : {"type" : "string", "analyzer":"keyword"},  
"\_all" : {"type" : "string", "analyzer":"uax\_url\_email"}  
}  
}  
}'

but id doesn't work. It throws the error:  
{"error":"MapperParsingException[Analyzer [uax\_url\_email] not found  
for field [\_all]]","status":400}

Thanks again.  
Best regards,  
Hugo

On 14 Jan, 15:23, Clinton Gormley [cl...@traveljury.com](mailto:cl...@traveljury.com) wrote:

> On Sat, 2012-01-14 at 07:12 -0800, Hugo wrote:
> 
> > Hi Clinton,  
> > Thanks for the help.  
> > Is it possible to change the behaviour of \_all so it finds the emails  
> > also?
> 
> Hi Hugo,
> 
> you could change the analyzer that \_all uses to the uax\_url\_email  
> analyzer, which is the same as the standard analyzer except that it  
> keeps email addresses and urls as single tokens
> 
> clint
> 
> > Thanks again.
> 
> > Best regards,  
> > Hugo
> 
> > On 14 Jan, 09:43, Clinton Gormley [cl...@traveljury.com](mailto:cl...@traveljury.com) wrote:
> > 
> > > Hiya
> 
> > > > I've created an index with the following mapping:  
> > > > "email" : {"type" : "string", "analyzer":"keyword"}  
> > > > And then I've created the following query:
> 
> > > > $ curl -XGET '[http://localhost:9200/users/info/\_search?pretty=1'-d](http://localhost:9200/users/info/_search?pretty=1'-d) '  
> > > > { "term" : { "\_all" : "[us...@email.com](mailto:us...@email.com)" } },
> 
> > > You have set the 'email' field to use they keyword analyzer, but then  
> > > you are querying the \_all field, which uses the standard analyzer by  
> > > default.
> 
> > > So your email address is not stored in \_all as the single term  
> > > "[us...@email.com](mailto:us...@email.com)".
> 
> > > Try this clause instead:
> 
> > > ```
> > > { "term" : { "email" : "us...@email.com" } },
> > > 
> > > ```
> 
> > > clint

---

<div class="post-metadata">

**Author:** ![Clinton\_Gormley](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)\
**Post date:** [January 15, 2012, 10:25am UTC](https://discuss.elastic.co/t/find-e-mail/6376/6 "2012-01-15T10:25:51Z")

</div>

Hi Hugo

> ```
> "_all" : {"type" : "string", "analyzer":"uax_url_email"}
> 
> ```

> but id doesn't work. It throws the error:  
> {"error":"MapperParsingException[Analyzer [uax\_url\_email] not found  
> for field [\_all]]","status":400}

Sorry - the uax\_url\_email is a tokenizer, not an analyzer, so you need  
to create your own analyzer to use it.

You can only do this at index creation time, so delete your current  
index, then try this:

curl -XPUT '[http://127.0.0.1:9200/users/?pretty=1](http://127.0.0.1:9200/users/?pretty=1)' -d '  
{  
"settings" : {  
"analysis" : {  
"analyzer" : {  
"uax\_url\_email" : {  
"filters" : [  
"standard",  
"lowercase",  
"stop"  
],  
"tokenizer" : "uax\_url\_email"  
}  
}  
}  
},  
"mappings" : {  
"info" : {  
"properties" : {  
"email" : {  
"type" : "string",  
"analyzer" : "keyword"  
},  
"\_all" : {  
"type" : "string",  
"analyzer" : "uax\_url\_email"  
},  
"name" : {  
"fields" : {  
"untouched" : {  
"index" : "not\_analyzed",  
"type" : "string"  
},  
"name" : {  
"type" : "string"  
}  
},  
"type" : "multi\_field"  
}  
}  
}  
}  
}  
'

clint

---

<div class="post-metadata">

**Author:** ![Hugo](https://avatars.discourse-cdn.com/v4/letter/h/b38774/32.png) [@Hugo](https://discuss.elastic.co/u/Hugo)\
**Post date:** [January 15, 2012, 1:57pm UTC](https://discuss.elastic.co/t/find-e-mail/6376/7 "2012-01-15T13:57:04Z")

</div>

Hi Clinton,

Thanks again for your help.  
I followed your suggestion but it still does not work. The following  
query returns 0 hits:

curl -XGET '[http://localhost:9200/users/info/\_search?pretty=1](http://localhost:9200/users/info/_search?pretty=1)' -d '  
{  
"query" : {  
"filtered" : {  
"query" : { "match\_all" : {} },  
"filter" : {  
"and" : [  
{ "term" : { "\_all" : "[user1@email.com](mailto:user1@email.com)" } },  
{ "not": { "filter" : { "ids" : { "values" :  
["400"] } } } }  
]  
}  
}  
}  
}'

I noticed that if I change the query to find the string "[email.com](http://email.com)" it  
returns 2 hits:

curl -XGET '[http://localhost:9200/users/info/\_search?pretty=1](http://localhost:9200/users/info/_search?pretty=1)' -d '  
{  
"query" : {  
"filtered" : {  
"query" : { "match\_all" : {} },  
"filter" : {  
"and" : [  
{ "term" : { "\_all" : "[email.com](http://email.com)" } },  
{ "not": { "filter" : { "ids" : { "values" :  
["400"] } } } }  
]  
}  
}  
}  
}'

Thanks again.  
Best regards,  
Hugo

On 15 Jan, 10:25, Clinton Gormley [cl...@traveljury.com](mailto:cl...@traveljury.com) wrote:

> Hi Hugo
> 
> > ```
> > "_all" : {"type" : "string", "analyzer":"uax_url_email"}
> > 
> > ```
> > 
> > but id doesn't work. It throws the error:  
> > {"error":"MapperParsingException[Analyzer [uax\_url\_email] not found  
> > for field [\_all]]","status":400}
> 
> Sorry - the uax\_url\_email is a tokenizer, not an analyzer, so you need  
> to create your own analyzer to use it.
> 
> You can only do this at index creation time, so delete your current  
> index, then try this:
> 
> curl -XPUT '[http://127.0.0.1:9200/users/?pretty=1](http://127.0.0.1:9200/users/?pretty=1)' -d '  
> {  
> "settings" : {  
> "analysis" : {  
> "analyzer" : {  
> "uax\_url\_email" : {  
> "filters" : [  
> "standard",  
> "lowercase",  
> "stop"  
> ],  
> "tokenizer" : "uax\_url\_email"  
> }  
> }  
> }  
> },  
> "mappings" : {  
> "info" : {  
> "properties" : {  
> "email" : {  
> "type" : "string",  
> "analyzer" : "keyword"  
> },  
> "\_all" : {  
> "type" : "string",  
> "analyzer" : "uax\_url\_email"  
> },  
> "name" : {  
> "fields" : {  
> "untouched" : {  
> "index" : "not\_analyzed",  
> "type" : "string"  
> },  
> "name" : {  
> "type" : "string"  
> }  
> },  
> "type" : "multi\_field"  
> }  
> }  
> }  
> }}
> 
> '
> 
> clint

---

<div class="post-metadata">

**Author:** ![Clinton\_Gormley](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)\
**Post date:** [January 16, 2012, 10:24am UTC](https://discuss.elastic.co/t/find-e-mail/6376/8 "2012-01-16T10:24:29Z")

</div>

On Sun, 2012-01-15 at 05:57 -0800, Hugo wrote:

> Hi Clinton,
> 
> Thanks again for your help.  
> I followed your suggestion but it still does not work. The following  
> query returns 0 hits:

Oh I should really test this stuff out before posting 🙂

OK, I was defining the analyzer for \_all in the wrong place, and I was  
misspelling 'filter' as 'filters'.

here is a working version: [gist:1620128 · GitHub](https://gist.github.com/1620128)

clint

---

<div class="post-metadata">

**Author:** ![Hugo](https://avatars.discourse-cdn.com/v4/letter/h/b38774/32.png) [@Hugo](https://discuss.elastic.co/u/Hugo)\
**Post date:** [January 16, 2012, 4:14pm UTC](https://discuss.elastic.co/t/find-e-mail/6376/9 "2012-01-16T16:14:10Z")

</div>

Hi Clinton,

Its working. Thanks for all your help!!!

Best regards,  
Hugo

On 16 Jan, 10:24, Clinton Gormley [cl...@traveljury.com](mailto:cl...@traveljury.com) wrote:

> On Sun, 2012-01-15 at 05:57 -0800, Hugo wrote:
> 
> > Hi Clinton,
> 
> > Thanks again for your help.  
> > I followed your suggestion but it still does not work. The following  
> > query returns 0 hits:
> 
> Oh I should really test this stuff out before posting 🙂
> 
> OK, I was defining the analyzer for \_all in the wrong place, and I was  
> misspelling 'filter' as 'filters'.
> 
> here is a working version:[gist:1620128 · GitHub](https://gist.github.com/1620128)
> 
> clint

---

<div class="post-metadata">

**Author:** ![kodermax](https://avatars.discourse-cdn.com/v4/letter/k/9d8465/32.png) [@kodermax](https://discuss.elastic.co/u/kodermax)\
**Post date:** [October 19, 2015, 2:42pm UTC](https://discuss.elastic.co/t/find-e-mail/6376/10 "2015-10-19T14:42:45Z")

</div>

> [@Hugo](#):
>
> You can only do this at index creation time, so delete your current  
> index, then try this:

Hello, Can I change settings without delete index?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:44pm UTC](https://discuss.elastic.co/t/find-e-mail/6376/11 "2017-07-05T23:44:02Z")

</div>