# Avoiding delete by query to write in logs

**URL:** <https://discuss.elastic.co/t/avoiding-delete-by-query-to-write-in-logs/70711>\
**Category:** Elasticsearch\
**Created:** [January 5, 2017, 4:41pm UTC](https://discuss.elastic.co/t/avoiding-delete-by-query-to-write-in-logs/70711 "2017-01-05T16:41:17Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![saisn](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@saisn](https://discuss.elastic.co/u/saisn)\
**Post date:** [January 5, 2017, 4:41pm UTC](https://discuss.elastic.co/t/avoiding-delete-by-query-to-write-in-logs/70711/1 "2017-01-05T16:41:17Z")

</div>

Hi I am using delete by query plugin to delete around 10 million records. However, doing so is eating up my disk space as each document deletion event is recorded in elasticsearch logs file. How can i avoid elasticsearch writing this delete to logs.

P.S. my elasticsearch version is 2.4

Regards,  
S N

---

<div class="post-metadata">

**Author:** ![mikemccand](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@mikemccand](https://discuss.elastic.co/u/mikemccand)\
**Post date:** [January 5, 2017, 6:23pm UTC](https://discuss.elastic.co/t/avoiding-delete-by-query-to-write-in-logs/70711/2 "2017-01-05T18:23:52Z")

</div>

Can you configure the logger to reduce the level for the ES component that's writing the log?

Mike McCandless

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 5, 2017, 7:11pm UTC](https://discuss.elastic.co/t/avoiding-delete-by-query-to-write-in-logs/70711/3 "2017-01-05T19:11:18Z")

</div>

Did you modify logging level?

It should not log that by default AFAIK.

Are you sure it takes more space in logs or that's because of the normal behavior of elasticsearch when it comes to deletion of documents?  
I mean that removing a document takes more space because of Lucene immutable segments.

Is that what you are seeing or is it really about logs?

---

<div class="post-metadata">

**Author:** ![saisn](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@saisn](https://discuss.elastic.co/u/saisn)\
**Post date:** [January 9, 2017, 2:06am UTC](https://discuss.elastic.co/t/avoiding-delete-by-query-to-write-in-logs/70711/4 "2017-01-09T02:06:10Z")

</div>

Sorry for delayed response. I'm trying to figure out as how the logger can be configured. It's helpful if you can guide me.

Thanks

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 9, 2017, 6:01am UTC](https://discuss.elastic.co/t/avoiding-delete-by-query-to-write-in-logs/70711/5 "2017-01-09T06:01:02Z")

</div>

Can you share one of theses logs you mentioned at first?

---

<div class="post-metadata">

**Author:** ![saisn](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@saisn](https://discuss.elastic.co/u/saisn)\
**Post date:** [January 9, 2017, 8:17am UTC](https://discuss.elastic.co/t/avoiding-delete-by-query-to-write-in-logs/70711/6 "2017-01-09T08:17:10Z")

</div>

Here is what its getting filled with in the log. I also forgot to mention that i'm using searchgaurd.

[2017-01-09 08:11:54,815][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore\_unavailable=false, allow\_no\_indices=false, expand\_wildcards\_open=false, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=false, forbid\_closed\_indices=true]  
[2017-01-09 08:11:54,815][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices [index\_name]  
[2017-01-09 08:11:54,815][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [index\_name] to [index\_name]

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 9, 2017, 8:47am UTC](https://discuss.elastic.co/t/avoiding-delete-by-query-to-write-in-logs/70711/7 "2017-01-09T08:47:10Z")

</div>

So you are using an open source plugin which does that logging.  
Have a look at their documentation.

Here may be change `config/logging.yml` and change the log level for package `com.floragunn.searchguard` to `INFO` or `WARN`.

But it's not caused by elasticsearch code.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2017, 8:47am UTC](https://discuss.elastic.co/t/avoiding-delete-by-query-to-write-in-logs/70711/8 "2017-02-06T08:47:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
