# Delete All ES 2.4.1 Data for a Given filebeat Host **URL:** \ **Category:** Elasticsearch\ **Created:** [May 10, 2017, 8:47pm UTC](https://discuss.elastic.co/t/delete-all-es-2-4-1-data-for-a-given-filebeat-host/85305 "2017-05-10T20:47:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Nastooh](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@Nastooh](https://discuss.elastic.co/u/Nastooh)\ **Post date:** [May 10, 2017, 8:47pm UTC](https://discuss.elastic.co/t/delete-all-es-2-4-1-data-for-a-given-filebeat-host/85305/1 "2017-05-10T20:47:20Z")
Hi Trying to clear all data belonging to a particular beat host. Started with the following query: `curl -XGET 'localhost:9200/filebeat-2017.05.10/_search?pretty' -H 'Content-Type: application/json' -d '{"query":{"filtered":{"query":{"query_string":{"query":"(beat.hostname:$BEAT_HOSTNAME)"}}}}}'`, which returns the desired results. I was hoping after installing delete-by-query, and replacing GET with DELETE the removal should take place. However, I get the following: `No handler found for uri [/filebeat-2017.05.10/_search?pretty] and method [DELETE]` (Probably, I am doing this wrong.) Any ideas as how to remove beat data for a given host? Cheers, ---
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [May 11, 2017, 5:51am UTC](https://discuss.elastic.co/t/delete-all-es-2-4-1-data-for-a-given-filebeat-host/85305/2 "2017-05-11T05:51:21Z")
Looks like you are using the wrong syntax for delete by query plugin. It should be `_query` instead of `_search`. Check out [https://www.elastic.co/guide/en/elasticsearch/plugins/2.4/delete-by-query-usage.html](https://www.elastic.co/guide/en/elasticsearch/plugins/2.4/delete-by-query-usage.html) ---
**Author:** ![Nastooh](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@Nastooh](https://discuss.elastic.co/u/Nastooh)\ **Post date:** [May 11, 2017, 3:47pm UTC](https://discuss.elastic.co/t/delete-all-es-2-4-1-data-for-a-given-filebeat-host/85305/3 "2017-05-11T15:47:22Z")
Hi Thank you for your reply. "\_query" does not seem to be a valid option in 2.4.1: GET: curl -XGET 'localhost:9200/filebeat-2017.05.10/\_query?pretty' -d '{"query":{"filtered":{"query":{"query\_string":{"query":"($BEAT\_HOSTNAME)"}}}}}' { "error" : { "root\_cause" : [ { "type" : "illegal\_argument\_exception", "reason" : "No feature for name [\_query]" } ], "type" : "illegal\_argument\_exception", "reason" : "No feature for name [\_query]" }, "status" : 400 } DELETE: curl -XDELETE 'localhost:9200/filebeat-2017.05.10/\_query?pretty' -d '{"query":{"filtered":{"query":{"query\_string":{"query":"($BEAT\_HOSTNAME)"}}}}}' No handler found for uri [/filebeat-2017.05.10/\_query?pretty] and method [DELETE] Cheers, ---
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [May 13, 2017, 6:41am UTC](https://discuss.elastic.co/t/delete-all-es-2-4-1-data-for-a-given-filebeat-host/85305/4 "2017-05-13T06:41:11Z")
It worked fine for me on 2.4.1 ```auto DELETE test/_query { "query": { "filtered": { "query": { "query_string": { "query": "anh" } } } } } ``` ```auto { "took": 201, "timed_out": false, "_indices": { "_all": { "found": 3, "deleted": 3, "missing": 0, "failed": 0 }, "test": { "found": 3, "deleted": 3, "missing": 0, "failed": 0 } }, "failures": [ ] } ``` Have you done this? > The plugin must be installed on every node in the cluster, and each node must be restarted after installation. If yes, perhaps install the Kopf plugin [GitHub - lmenezes/elasticsearch-kopf: web admin interface for elasticsearch](https://github.com/lmenezes/elasticsearch-kopf) and run the query from there. ---
**Author:** ![Nastooh](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@Nastooh](https://discuss.elastic.co/u/Nastooh)\ **Post date:** [May 15, 2017, 1:03am UTC](https://discuss.elastic.co/t/delete-all-es-2-4-1-data-for-a-given-filebeat-host/85305/5 "2017-05-15T01:03:55Z")
Thank you for your reply. I am wondering if you have the opportunity to try the above on a filebeat server. I have tried 2 variations: 1- curl -XDELETE 'localhost:9200/filebeat-_/\_query' -H 'Content-Type: application/json' -d '{"query":{"filtered":{"query":{"query\_string":{"query":"SomeHostName"}}}}}' No handler found for uri [/filebeat-_/\_query] and method [DELETE] 2- curl -XDELETE 'localhost:9200/filebeat-_/\_query' -H 'Content-Type: application/json' -d '{"query":{"filtered":{"query":{"query\_string":{"query":"(beat.hostname:vanlabvpa18.cisco.com)"}}}}}' No handler found for uri [/filebeat-_/\_query] and method [DELETE] Both seem to indicate that there is no delete and query handler on filebeat entries. Note that I can completely wipe out filebeat indices with: `curl -XDELETE 'localhost:9200/filebeat-*?pretty'` And as noted above, I can GET and query filebeat entries; however, combining the 2 doesn't seem to be possible. ( Kopf seems to be deprecated in favour of cerebro. Will look into it.) Cheers, ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 12, 2017, 1:13am UTC](https://discuss.elastic.co/t/delete-all-es-2-4-1-data-for-a-given-filebeat-host/85305/6 "2017-06-12T01:13:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.