I defined a custom analyzer that I was surprised not built-in.
analyzer": {
"keyword_lowercase": {
"type": "custom",
"filter": [
"lowercase"
],
"tokenizer": "keyword"
}
}
Then my mapping for this field is:
"email": {
"type": "string",
"analyzer": "keyword_lowercase"
}
This works great. (http://.../_analyze?field=email&[email protected]) ->
"tokens": [
{
"token": "[email protected]",
"start_offset": 0,
"end_offset": 16,
"type": "word",
"position": 1
}
]
Finding by that keyword works great. http://.../[email protected] yields results.
The problem is trying to incorporate wildcards anywhere in the Query String Query. http://.../_search?q=*[email protected] yields no results. I would expect results containing emails such as "[email protected]" and "[email protected]".
It looks like elasticsearch performs the search with the default analyzer, which doesn't make sense. Shouldn't it perform the search with each field's own default analyzer?
I.E. http://.../_search?q=email:*[email protected] returns results because I am telling it which analyzer to use based upon the field.
Can elasticsearch not do this?