Searching emails by domain

Elastic Stack Elasticsearch
4

Why do you say that? Possibly tools like Logstash and Node ingest could help there.

Indeed a reverse token filter could help replace loading wildcards with suffix queries, but it will require reindexing too, like the extraction of the user and domain fields.

Here is an example if you'd like:

DELETE index

PUT index
{
  "settings": {
    "index": {
      "analysis": {
        "analyzer": {
          "reverse_keyword": {
            "type": "custom",
            "tokenizer": "keyword",
            "filter": ["reverse"]
          }
        }
      }
    }
  }, 
  "mappings": {
    "type": {
      "properties": {
        "email": {
          "type": "keyword",
          "fields": {
            "reverse": {
              "type": "text",
              "analyzer": "reverse_keyword"
            }
          }
        }
      }
    }
  }
}

PUT index/type/1
{
  "email": "user@example.org"
}

GET index/_search
{
  "query": {
    "wildcard": {
      "email": {
        "value": "*.org"
      }
    }
  }
}

GET index/_search
{
  "query": {
    "wildcard": {
      "email.reverse": {
        "value": "gro.*"
      }
    }
  }
}

The two queries will match the same documents except that the second one will perform much faster since it does not have a leading wildcard.

1 Like