# Need to analyse email addresses **URL:** \ **Category:** Elasticsearch\ **Created:** [September 14, 2016, 8:17am UTC](https://discuss.elastic.co/t/need-to-analyse-email-addresses/60466 "2016-09-14T08:17:09Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![somerandomguy](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@somerandomguy](https://discuss.elastic.co/u/somerandomguy)\ **Post date:** [September 14, 2016, 8:17am UTC](https://discuss.elastic.co/t/need-to-analyse-email-addresses/60466/1 "2016-09-14T08:17:09Z")
Hi. I need to analyse email addresses because right now when they come in and I create a visualise i get 1 field with john.doe and then another with @domain.com. I created a new index with this: [https://www.elastic.co/guide/en/elasticsearch/reference/2.3/analysis-pattern-capture-tokenfilter.html](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/analysis-pattern-capture-tokenfilter.html) And then I sent some emails into through my Logstash input/output but Kibana is still not letting me analyse them. Actually in the left hand pane under message it only has the word 'm'? Are there any gotchas that I need to look out for? ---
**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\ **Post date:** [September 14, 2016, 9:06am UTC](https://discuss.elastic.co/t/need-to-analyse-email-addresses/60466/2 "2016-09-14T09:06:52Z")
Hi, Have you also tried using the [email-tokenizer](https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-uaxurlemail-tokenizer.html)? Also for debugging purposes I'd suggest to take logstash out of the picture, sent some docs manually to ES (e.g. via curl) and see if search works as expected on those email fields. Maybe its also logstash doing the tokenizing of the email adresses. ---
**Author:** ![somerandomguy](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@somerandomguy](https://discuss.elastic.co/u/somerandomguy)\ **Post date:** [October 13, 2016, 10:41pm UTC](https://discuss.elastic.co/t/need-to-analyse-email-addresses/60466/3 "2016-10-13T22:41:24Z")
Hi. Do you have an example template that I can upload to ES for this to work? ---
**Author:** ![somerandomguy](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@somerandomguy](https://discuss.elastic.co/u/somerandomguy)\ **Post date:** [October 13, 2016, 11:57pm UTC](https://discuss.elastic.co/t/need-to-analyse-email-addresses/60466/4 "2016-10-13T23:57:49Z")
So I have uploaded this email tokenizer to my /incoming index. [https://www.elastic.co/guide/en/elasticsearch/reference/2.3/analysis-pattern-capture-tokenfilter.html](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/analysis-pattern-capture-tokenfilter.html) And did a dummy import of a few email addresses but still when I try to do a visualisation it separates out user id from the domain name.. ---
**Author:** ![somerandomguy](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@somerandomguy](https://discuss.elastic.co/u/somerandomguy)\ **Post date:** [October 20, 2016, 11:32pm UTC](https://discuss.elastic.co/t/need-to-analyse-email-addresses/60466/5 "2016-10-20T23:32:06Z")
Created an index with this and now when I create a visualisation email addresses they are combined with the [userid@domain.name](mailto:userid@domain.name) instead of being broken out by user and domain name [https://github.com/imotov/elasticsearch-test-scripts/blob/master/email\_default\_analyzer.sh](https://github.com/imotov/elasticsearch-test-scripts/blob/master/email_default_analyzer.sh). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:10pm UTC](https://discuss.elastic.co/t/need-to-analyse-email-addresses/60466/6 "2017-07-05T22:10:41Z")