# Searching emails by domain

**URL:** <https://discuss.elastic.co/t/searching-emails-by-domain/69550>\
**Category:** Elasticsearch\
**Created:** [December 20, 2016, 10:08am UTC](https://discuss.elastic.co/t/searching-emails-by-domain/69550 "2016-12-20T10:08:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![smugmane](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@smugmane](https://discuss.elastic.co/u/smugmane)\
**Post date:** [December 20, 2016, 10:08am UTC](https://discuss.elastic.co/t/searching-emails-by-domain/69550/1 "2016-12-20T10:08:04Z")

</div>

I've been trying to find out how to search through millions of emails with wildcards if possible.

Examples of searches would go like

1. \*@domain
2. user@\*
3. \*keyword@domain

I'm still new to ES and have been trying to find a solution now for quite a while.  
Any suggestions?

---

<div class="post-metadata">

**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\
**Post date:** [December 20, 2016, 10:13am UTC](https://discuss.elastic.co/t/searching-emails-by-domain/69550/2 "2016-12-20T10:13:13Z")

</div>

The most efficient way would be to index the name and domain parts of your email into different properties of your document, eg.

```auto
 {
  "email": "user@example.org",
  "email_name": "user",
  "email_domain": "example.org"
}

```

Otherwise you can use wildcard queries [https://www.elastic.co/guide/en/elasticsearch/reference/5.1/query-dsl-wildcard-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.1/query-dsl-wildcard-query.html) but they might be slow when there are few characters before the first wildcard (especially leading wildcards).

---

<div class="post-metadata">

**Author:** ![smugmane](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@smugmane](https://discuss.elastic.co/u/smugmane)\
**Post date:** [December 20, 2016, 10:25am UTC](https://discuss.elastic.co/t/searching-emails-by-domain/69550/3 "2016-12-20T10:25:06Z")

</div>

It would be very difficult to parse all the data I've been given and to be able to do that.  
I was using wildcard query before but once I reached a certain number of emails the node timeout from the searches.

I was told earlier that a reverse token filter and a suffix query would increase the search significantly, but I'm a bit puzzled trying to get it to work.  
I'm using Elasticsearch-PHP to handle the searches.

---

<div class="post-metadata">

**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\
**Post date:** [December 20, 2016, 10:39am UTC](https://discuss.elastic.co/t/searching-emails-by-domain/69550/4 "2016-12-20T10:39:26Z")

</div>

> [@smugmane](#):
>
> It would be very difficult to parse all the data I've been given and to be able to do that.

Why do you say that? Possibly tools like Logstash and Node ingest could help there.

> [@smugmane](#):
>
> I was told earlier that a reverse token filter and a suffix query would increase the search significantly

Indeed a reverse token filter could help replace loading wildcards with suffix queries, but it will require reindexing too, like the extraction of the user and domain fields.

Here is an example if you'd like:

```auto
DELETE index

PUT index
{
  "settings": {
    "index": {
      "analysis": {
        "analyzer": {
          "reverse_keyword": {
            "type": "custom",
            "tokenizer": "keyword",
            "filter": ["reverse"]
          }
        }
      }
    }
  }, 
  "mappings": {
    "type": {
      "properties": {
        "email": {
          "type": "keyword",
          "fields": {
            "reverse": {
              "type": "text",
              "analyzer": "reverse_keyword"
            }
          }
        }
      }
    }
  }
}

PUT index/type/1
{
  "email": "user@example.org"
}

GET index/_search
{
  "query": {
    "wildcard": {
      "email": {
        "value": "*.org"
      }
    }
  }
}

GET index/_search
{
  "query": {
    "wildcard": {
      "email.reverse": {
        "value": "gro.*"
      }
    }
  }
}

```

The two queries will match the same documents except that the second one will perform much faster since it does not have a leading wildcard.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 17, 2017, 10:39am UTC](https://discuss.elastic.co/t/searching-emails-by-domain/69550/5 "2017-01-17T10:39:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.