# Searching email address **URL:** \ **Category:** Elasticsearch\ **Created:** [December 18, 2011, 7:31pm UTC](https://discuss.elastic.co/t/searching-email-address/6188 "2011-12-18T19:31:59Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Jack\_4](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@Jack\_4](https://discuss.elastic.co/u/Jack_4)\ **Post date:** [December 18, 2011, 7:31pm UTC](https://discuss.elastic.co/t/searching-email-address/6188/1 "2011-12-18T19:31:59Z")
Hi All, I was trying to use ES to for syslog searching of mail server logs. The fields are not split into an address field. just 1 field per syslog line . Tried several combinations but can't seem to find a way to search a full email address {"query" : {"term" : { "line" : "foo@gmail.com" }}' gets no hits {"query" : {"field" : { "line" : "foo@gmail.com" }}' gets the correct entries on as top hits but also shows ALL gmail users. Any suggestions on how to make it only return the exact email address lines ---
**Author:** ![Kun\_Niu](https://avatars.discourse-cdn.com/v4/letter/k/8c91f0/32.png) [@Kun\_Niu](https://discuss.elastic.co/u/Kun_Niu)\ **Post date:** [December 18, 2011, 7:35pm UTC](https://discuss.elastic.co/t/searching-email-address/6188/2 "2011-12-18T19:35:21Z")
Have you tried to set the mapping to line to not\_analyzed? Kun Niu > -----Original Message----- > From: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) > [[mailto:elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com)] On Behalf Of Jack > Sent: 2011年12月19日 3:32 > To: elasticsearch > Subject: searching email address > > Hi All, > > I was trying to use ES to for syslog searching of mail server logs. > The fields are not split into an address field. just 1 field per syslog > line . Tried > several combinations but can't seem to find a way to search a full email > address > > {"query" : {"term" : { "line" : "[foo@gmail.com](mailto:foo@gmail.com)" }}' gets no hits > > {"query" : {"field" : { "line" : "[foo@gmail.com](mailto:foo@gmail.com)" }}' gets the correct > entries on > as top hits but also shows ALL gmail users. > > Any suggestions on how to make it only return the exact email address > lines ---
**Author:** ![Michael\_Sick](https://avatars.discourse-cdn.com/v4/letter/m/22d042/32.png) [@Michael\_Sick](https://discuss.elastic.co/u/Michael_Sick)\ **Post date:** [December 18, 2011, 9:58pm UTC](https://discuss.elastic.co/t/searching-email-address/6188/3 "2011-12-18T21:58:24Z")
Jack, Have you taken a look at logstash? It performs a number of log analysis tasks. [http://code.google.com/p/logstash/](http://code.google.com/p/logstash/) --Mike 2011/12/18 Kun Niu [haoniukun@gmail.com](mailto:haoniukun@gmail.com) > Have you tried to set the mapping to line to not\_analyzed? > > Kun Niu > > > -----Original Message----- > > From: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) > > [[mailto:elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com)] On Behalf Of Jack > > Sent: 2011年12月19日 3:32 > > To: elasticsearch > > Subject: searching email address > > > > Hi All, > > > > I was trying to use ES to for syslog searching of mail server logs. > > The fields are not split into an address field. just 1 field per syslog > > line . Tried > > several combinations but can't seem to find a way to search a full email > > address > > > > {"query" : {"term" : { "line" : "[foo@gmail.com](mailto:foo@gmail.com)" }}' gets no hits > > > > {"query" : {"field" : { "line" : "[foo@gmail.com](mailto:foo@gmail.com)" }}' gets the correct > > entries on > > as top hits but also shows ALL gmail users. > > > > Any suggestions on how to make it only return the exact email address > > lines ---
**Author:** ![Jack\_4](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@Jack\_4](https://discuss.elastic.co/u/Jack_4)\ **Post date:** [December 18, 2011, 10:11pm UTC](https://discuss.elastic.co/t/searching-email-address/6188/4 "2011-12-18T22:11:40Z")
Thanks a lot for the tip. That was it. On Dec 18, 11:35 am, "Kun Niu" [haoniu...@gmail.com](mailto:haoniu...@gmail.com) wrote: > Have you tried to set the mapping to line to not\_analyzed? > > Kun Niu > > > -----Original Message----- > > From: [elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com) > > [[mailto:elasticsearch@googlegroups.com](mailto:elasticsearch@googlegroups.com)] On Behalf Of Jack > > Sent: 2011年12月19日 3:32 > > To: elasticsearch > > Subject: searching email address > > > Hi All, > > > I was trying to use ES to for syslog searching of mail server logs. > > The fields are not split into an address field. just 1 field per syslog > > line . Tried > > several combinations but can't seem to find a way to search a full email > > address > > > {"query" : {"term" : { "line" : "[f...@gmail.com](mailto:f...@gmail.com)" }}' gets no hits > > > {"query" : {"field" : { "line" : "[f...@gmail.com](mailto:f...@gmail.com)" }}' gets the correct > > entries on > > as top hits but also shows ALL gmail users. > > > Any suggestions on how to make it only return the exact email address > > lines ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 3:45am UTC](https://discuss.elastic.co/t/searching-email-address/6188/5 "2017-07-06T03:45:01Z")