Special characters on query_string in elasticsearch

Question

Assuming I have an Index & I added to it a document, by this statement:

POST /temp/item
{
    "text": "dave@domain.com dave@do-main.com one,two three:four"
}

I would like some query statements to return this document, for example:

1. *@domain*
2. *@do-*
3. one,two
4. three:four --> This actually yield an error

Each selected by a statement similar to this:

GET /temp/item/_search
{
 "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "*@domain*",
            "allow_leading_wildcard": "true",
            "default_operator": "AND"
          }
        }
      ]
    }
  }
}

None of them returned.

I understood the reason was that the Analyzer set to standard, it splitted the text by any wordboundry. So I figured that I must change the analyzer to whitespace, like this:

PUT /temp
{
  "mappings": {
    "item" : {
      "properties" : {
        "text" : {
          "type" :    "string",
          "analyzer": "whitespace"
        }
      }
    }
  }
}

Doing so didn't solve the problem. None of the statement returned the document.

Questions

1. How can I configure the Index or Change the query statement so that all of the examples above will capture.
2. Why after I changed the analyzer to "whitespace" Elasticsearch didn't return the document?

Answer 1

Almost there you need to explicitly specify the 'field' for query_string to match against. One can specify using the default_field or fields option the case

Example:

{
 "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "*@domain*",
            "fields": [
               "text"
            ], 
            "allow_leading_wildcard": "true",
            "default_operator": "AND"
          }
        }
      ]
    }
  }
}

If nothing is specified query_string would use the _all field.

2) three:four needs to be wrapped in double-quotes else it would be interpreted as field:three match query:four Example:

{
 "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "\"three:four\"",
            "fields": [
               "text"
            ], 
            "allow_leading_wildcard": "true",
            "default_operator": "AND"
          }
        }
      ]
    }
  }
}