# Searching domain and subdomain returns more hits than searching for just the domain itself

**URL:** <https://discuss.elastic.co/t/searching-domain-and-subdomain-returns-more-hits-than-searching-for-just-the-domain-itself/176579>\
**Category:** Elasticsearch\
**Created:** [April 12, 2019, 8:42am UTC](https://discuss.elastic.co/t/searching-domain-and-subdomain-returns-more-hits-than-searching-for-just-the-domain-itself/176579 "2019-04-12T08:42:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aqiank](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aqiank/32/39723_2.png) [@aqiank](https://discuss.elastic.co/u/aqiank)\
**Post date:** [April 12, 2019, 8:42am UTC](https://discuss.elastic.co/t/searching-domain-and-subdomain-returns-more-hits-than-searching-for-just-the-domain-itself/176579/1 "2019-04-12T08:42:49Z")

</div>

Hi guys, I'm trying to make the number of hits the same when I do the queries "[example.com](http://example.com)" and "[example.com](http://example.com) [mail.example.com](http://mail.example.com)". However when I run "[example.com](http://example.com)", it returns less hits than "[example.com](http://example.com) [mail.example.com](http://mail.example.com)" or even just "[mail.example.com](http://mail.example.com)". When I see the documents returned from searching "[example.com](http://example.com)", it also has results of "[mail.example.com](http://mail.example.com)" but less. Ideally, I would like the number of hits to be the same.

If anyone has any idea or can point me at a right direction, I would really appreciate it!

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 12, 2019, 6:06pm UTC](https://discuss.elastic.co/t/searching-domain-and-subdomain-returns-more-hits-than-searching-for-just-the-domain-itself/176579/2 "2019-04-12T18:06:11Z")

</div>

Hey,

please include a fully fledged reproducable example of how you index your documents, and also how you are writing your query, as this is crucial for getting a good answer.

My first hunch would be that the queries are combined as an `OR` query and that you query ends up being a query for `mail OR example OR com` which will return more hits than `example OR com` - but this is all just an assumption.

--Alex

---

<div class="post-metadata">

**Author:** ![aqiank](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aqiank/32/39723_2.png) [@aqiank](https://discuss.elastic.co/u/aqiank)\
**Post date:** [April 13, 2019, 11:57am UTC](https://discuss.elastic.co/t/searching-domain-and-subdomain-returns-more-hits-than-searching-for-just-the-domain-itself/176579/3 "2019-04-13T11:57:49Z")

</div>

Hi @spinscale, thanks for responding!

I simply indexed it using this command:  
`curl -XPOST -H "Content-Type: application/json" http://localhost:9200/example/1/_create -d '{"text": "mail.example.com"}'`

The mapping is:

```auto
{
  "example": {
    "mappings": {
      "1": {
        "properties": {
          "text": {
            "type": "string"
          }
        }
      }
    }
  }
}

```

If I run `http://localhost:9200/_analyze?text=mail.example.com` on browser, the result is:

```auto
{
  "tokens": [
    {
      "token": "mail.example.com",
      "start_offset": 0,
      "end_offset": 16,
      "type": "<ALPHANUM>",
      "position": 0
    }
  ]
}

```

I guess what I want to know is, is there a way for both search results to match the same documents? Should I just pre-process the query to maybe replace it with something like `\*[example.com](http://example.com)?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2019, 11:57am UTC](https://discuss.elastic.co/t/searching-domain-and-subdomain-returns-more-hits-than-searching-for-just-the-domain-itself/176579/4 "2019-05-11T11:57:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.