# Prefix of special character on the id

**URL:** <https://discuss.elastic.co/t/prefix-of-special-character-on-the-id/278567>\
**Category:** Elasticsearch\
**Tags:** eql-elastic-query-language\
**Created:** [July 13, 2021, 3:28pm UTC](https://discuss.elastic.co/t/prefix-of-special-character-on-the-id/278567 "2021-07-13T15:28:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![stexxen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stexxen/32/68327_2.png) [@stexxen](https://discuss.elastic.co/u/stexxen)\
**Post date:** [July 13, 2021, 3:28pm UTC](https://discuss.elastic.co/t/prefix-of-special-character-on-the-id/278567/1 "2021-07-13T15:28:49Z")

</div>

I have inadvertently loaded some documents without sanitising the field that was meant to be the id.

So some records now have an id that begins with the ascii 09 i.e. the tab character

I can extract an individual record with  
`GET /nyy_uprn/_doc/%09100040171995`  
returns the following

```auto
{
  "_index" : "xxxxxxx",
  "_type" : "_doc",
  "_id" : """	100040171995""",
  "_version" : 1,
  "_seq_no" : 56576,
  "_primary_term" : 3,
  "found" : true,
  "_source" : {
    "id" : """	100040171995""",

```

You can see both the \_id and id both contain the char 09 and is escaped with double double-quotes.

However I cannot seem to retrieve these records using a `prefix` query  
I have tried the following

```auto
GET /nyy_uprn/_search
{
  "query": {
    "prefix": {
      "id": "\t"
    }
  }
}

```

and have also tried many variations along the forms

`"""	"""`  
`"\\t"`  
`"//t"`  
`"/t"`

I always get 0 records back. I'm not sure what is the problem here, as the tab character as valid json `\t` should work?

---

<div class="post-metadata">

**Author:** ![stexxen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stexxen/32/68327_2.png) [@stexxen](https://discuss.elastic.co/u/stexxen)\
**Post date:** [July 19, 2021, 9:31am UTC](https://discuss.elastic.co/t/prefix-of-special-character-on-the-id/278567/2 "2021-07-19T09:31:33Z")

</div>

Hi Does anyone have any ideas here?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 19, 2021, 9:58am UTC](https://discuss.elastic.co/t/prefix-of-special-character-on-the-id/278567/3 "2021-07-19T09:58:49Z")

</div>

You would need to specify the `_id` field instead of `id`. Maybe a script filter searching for ids starting with a tab helps...

```auto
GET test/_search
{
  "query": {
    "script": {
      "script": "doc['_id'].value.startsWith('\t')"
    }
  }
}

```

note: that one might be super slow depending on the amount of documents.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2021, 9:59am UTC](https://discuss.elastic.co/t/prefix-of-special-character-on-the-id/278567/4 "2021-08-16T09:59:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.