How to search for parts of a string in the _id field in an existing index


I am working with an existing Elastic Search index, trying to search for a string in the _id field.

The _id in this index consists of two concatinated strings, and I need to be able to search for the second part of that string.
After reading documentation I have found out that I probably should use ngram to search for a substring, but I can't make this work properly.

I have found an example online from someone who was trying to do the same, så I updated my index with the following:

PUT /"myIndex"
{"settings": {
    "number_of_shards": 1, 
    "analysis": {
        "filter": {
            "partial_filter": { 
                "type":     "ngram",
                "min_gram": 2,
                "max_gram": 20
        "analyzer": {
            "partial": {
                "type":      "custom",
                "tokenizer": "standard",
                "filter": [

And then tried to add this:

PUT /"index"/_mapping/type2
    "type2": {
        "properties": {
            "_id": {
                "type":     "string",
                "analyzer": "partial"

That gives me an exception: "Rejecting mapping update to [bci_report_provider_s_dev-"myIndex"] as the final mapping would have more than 1 type: [type2, bci-report]"

How can I resolve this, and is there another way to be able to de a partial search on the _id field?

Thanks a lot in advance!

Bjørn Olav Berg

I would recommend storing the id within the document.

Thanks for your reply. That wolud be the best solution and we will do that in the future, but we have an existing database with many millions of instances, which we need to search through.

Do you know if it is possible and if so, how, to copy the _id value to another field. I have tried to add a copy_to clause for the _id field, but am getting the message that the _id field cannot be defined twice in the index.

Thanks again!

Bjørn Olav Berg

As far as know that is not possible.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.