Delete By Query (Dry Run)

Elastic Stack Elasticsearch
1

I was looking to remove some bad fields from my documents and like this functionality but I don't see a dry run, test type option that would report back number of documents that would have been affected
https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-update-by-query.html

Now obviously, I could make a copy of the index, and run it against that , but I was hoping that there was a "TEST" option that run's the DELETE but does not apply the actual changes.

I am working off this article as an example

http://localhost:9200/type/_update_by_query?wait_for_completion=false&conflict=proceed
POST body:
{
  "script": ctx._source.remove("XXXXXXXXXXX"),
  "query": {
    "bool": {
      "must": [
        {
          "exists": {
            "field": "XXXXXXXXXXXXX"
          }
        }
      ]
    }
  }
}
2

If you switch the endpoint from _update_by_query to _search and remove the
top level script element you can see the docs it will try to hit.

Another option is to run reindex into a new index with the same query and
look at the results. You can use the size parameter to stop after a certain
number of changes for faster testing.

3

yah I thought about the _search suggestion, one of my earlier tests was falling on a Max field value.

No worries, thought that making a copy was the only real way to test. Though my indexes are pretty large.

I think I will just work carefully on live data and in major issues restore one of my snapshots from S3. Just was hopping to avoid that .

Thanks