# Unexpected search result

**URL:** <https://discuss.elastic.co/t/unexpected-search-result/26768>\
**Category:** Elasticsearch\
**Created:** [August 4, 2015, 3:03am UTC](https://discuss.elastic.co/t/unexpected-search-result/26768 "2015-08-04T03:03:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![esteban](https://avatars.discourse-cdn.com/v4/letter/e/f4b2a3/32.png) [@esteban](https://discuss.elastic.co/u/esteban)\
**Post date:** [August 4, 2015, 3:03am UTC](https://discuss.elastic.co/t/unexpected-search-result/26768/1 "2015-08-04T03:03:30Z")

</div>

Querying my index gives me an unexpected result. I have no explanation. Can anybody help me?

Q: [http://localhost:9200/prototype00/user/\_search?q=email:doesnotexist@sun.com.py](http://localhost:9200/prototype00/user/_search?q=email:doesnotexist@sun.com.py)

A: {"took":2,"timed\_out":false,"\_shards":{"total":5,"successful":5,"failed":0},"hits":{"total":1,"max\_score":0.30617762,"hits":[{"\_index":"prototype00","\_type":"user","\_id":"lC4zFucUSWGmuf\_6q9NcXw","\_score":0.30617762, "\_source" : {"email":"test2@sun.com.py","apps":["prototype"],"isActive":false,"activationId":"c7e059fc-eb44-4b7a-aff3-f7cb2755bdeb"}}]}}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 4, 2015, 5:51am UTC](https://discuss.elastic.co/t/unexpected-search-result/26768/2 "2015-08-04T05:51:33Z")

</div>

The `email` field is probably analyzed, i.e. both the data and query terms are broken up into tokens. test2@sun.com.py is tokenized and indexed as (test2, sun, com, py) and your query term is tokenized as (doesnotexist, sun, com, py). The query basically finds the intersection of these tokens, which is the non-empty set (sun, com, py), so the document matches your query. Fields containing email addresses should probably be set up as not\_analyzed since tokenization of email addresses rarely makes sense.

---

<div class="post-metadata">

**Author:** ![esteban](https://avatars.discourse-cdn.com/v4/letter/e/f4b2a3/32.png) [@esteban](https://discuss.elastic.co/u/esteban)\
**Post date:** [August 4, 2015, 4:14pm UTC](https://discuss.elastic.co/t/unexpected-search-result/26768/3 "2015-08-04T16:14:03Z")

</div>

Thanks, you were right. I thought I get away without an explicit mapping.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:57pm UTC](https://discuss.elastic.co/t/unexpected-search-result/26768/4 "2017-07-05T23:57:30Z")

</div>