How to do a wildcard or regex match on _id in elasticsearch?

In Elasticsearch, you may already know that the _id field serves as the unique identifier for a document. By default, Elasticsearch does not support direct search operations on the _id field using wildcards or regular expressions. This is because the _id field is designed for exact matching to efficiently locate and retrieve documents.

However, if you need to perform pattern matching on the _id, two approaches can be used:

Method 1: Using Script Queries

You can achieve this with Elasticsearch's script query functionality. By leveraging the Painless scripting language, you can write a small script to match the _id during the query. The drawback is poor performance, as it requires iterating through all documents and executing the script during the query.

Example Query:

json
GET /your_index/_search
{
  "query": {
    "bool": {
      "filter": {
        "script": {
          "script": {
            "source": "doc['_id'].value.matches('your_regex_here')",
            "lang": "painless"
          }
        }
      }
    }
  }
}

Replace 'your_regex_here' with the appropriate regular expression.

Method 2: Copy _id to Another Field

Since direct use of wildcards or regular expressions on the _id field results in inefficient performance, a more efficient strategy is to copy the _id value to another searchable field during indexing. This enables you to use standard query syntax on the new field, including wildcard and regular expression searches.

Indexing Setup Example:

json
PUT /your_index
{
  "mappings": {
    "properties": {
      "searchable_id": {
        "type": "keyword",
        "copy_to": "searchable_id"
      }
    }
  }
}

Search Query Example:

json
GET /your_index/_search
{
  "query": {
    "regexp": {
      "searchable_id": ".*pattern.*"
    }
  }
}

First, ensure the _id value is copied to the searchable_id field during indexing. Then, you can execute the regexp query to perform regular expression matching on searchable_id.

Summary

Although Elasticsearch itself does not support direct wildcard or regular expression queries on the _id field, similar functionality can be achieved through the methods above. The recommended approach is to copy _id to a new queryable field, as this is more performant.