This is mostly a side effect of the analyser you used for the filename 's field in the index.
Are you using simple analyser?
Simple analyser would throw away the “123456” and only take the token "pdf "
Can you try standard analyser for this field?
Standard analyser would create two tokens out of the text “123456.pdf” ,
like “123456” and “pdf”.