Searching domain and subdomain returns more hits than searching for just the domain itself

[aqiank]

Hi guys, I'm trying to make the number of hits the same when I do the queries "example.com" and "example.com mail.example.com". However when I run "example.com", it returns less hits than "example.com mail.example.com" or even just "mail.example.com". When I see the documents returned from searching "example.com", it also has results of "mail.example.com" but less. Ideally, I would like the number of hits to be the same.

If anyone has any idea or can point me at a right direction, I would really appreciate it!

[spinscale (Alexander Reelsen)]

Hey,

please include a fully fledged reproducable example of how you index your documents, and also how you are writing your query, as this is crucial for getting a good answer.

My first hunch would be that the queries are combined as an OR query and that you query ends up being a query for mail OR example OR com which will return more hits than example OR com - but this is all just an assumption.

--Alex

[aqiank]

Hi @spinscale, thanks for responding!

I simply indexed it using this command:
curl -XPOST -H "Content-Type: application/json" http://localhost:9200/example/1/_create -d '{"text": "mail.example.com"}'

The mapping is:

{
  "example": {
    "mappings": {
      "1": {
        "properties": {
          "text": {
            "type": "string"
          }
        }
      }
    }
  }
}

If I run http://localhost:9200/_analyze?text=mail.example.com on browser, the result is:

{
  "tokens": [
    {
      "token": "mail.example.com",
      "start_offset": 0,
      "end_offset": 16,
      "type": "<ALPHANUM>",
      "position": 0
    }
  ]
}

I guess what I want to know is, is there a way for both search results to match the same documents? Should I just pre-process the query to maybe replace it with something like `*example.com?