# Delete\_by\_query? , gateway timeout

**URL:** <https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430>\
**Category:** Elasticsearch\
**Created:** [November 5, 2018, 4:15pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430 "2018-11-05T16:15:56Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roque\_Moyano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roque_moyano/32/116329_2.png) [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\
**Post date:** [November 5, 2018, 4:15pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/1 "2018-11-05T16:15:56Z")

</div>

Hi , I have a problem , I have some huge indexes , and I want to delete some documents but only if they have some value , I have tried it:

POST docker-2018.07.05/\_delete\_by\_query?conflicts=proceed&timeout=10m  
{  
"query": {  
"match": {  
"TIPO": "INFO"  
}  
}  
}

but it fails for timeout , how can I fix it?

thanks in advance.

---

<div class="post-metadata">

**Author:** ![tamara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tamara/32/47095_2.png) [@tamara](https://discuss.elastic.co/u/tamara)\
**Post date:** [November 5, 2018, 4:32pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/2 "2018-11-05T16:32:44Z")

</div>

Hi,

You are having the fail because you defined the timeout in the url. You can do like this to have the timeout set to 20 minutes:

```
POST docker-2018.07.05/_delete_by_query?conflicts=proceed&amp;timeout=20m
{
  "query": {
    "match": {
     "TIPO": "INFO"
     }
   }
}

```

Change the timeout=20m to any value that fits your case, the default value is 5 minutes.

If you need more information you can find at:  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html)

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 5, 2018, 4:42pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/3 "2018-11-05T16:42:58Z")

</div>

What is the output of:

```auto
POST docker-2018.07.05/_search?size=1
{
  "query": {
    "match": {
      "TIPO": "INFO"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Roque\_Moyano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roque_moyano/32/116329_2.png) [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\
**Post date:** [November 5, 2018, 4:55pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/4 "2018-11-05T16:55:23Z")

</div>

the output is:

{  
"took": 19,  
"timed\_out": false,  
"\_shards": {  
"total": 5,  
"successful": 5,  
"skipped": 0,  
"failed": 0  
},  
"hits": {  
"total": 3827639,  
"max\_score": 0.000890049,  
"hits": [  
{  
"\_index": "docker-2018.07.06",  
"\_type": "doc",  
"\_id": "8hfkbGQBCKk4lo83XTkW",  
"\_score": 0.000890049,  
"\_source": {  
"zabbix\_host": "elk01",  
"TIPO": "INFO",  
"message": "[2018-07-05T21:00:59] | [PROD] | [WSRESTTRAMITES] | [INFO] | [c.w.f.TokenFilter] | [tokenHeader: 0ec078efabf7d9694f19e2dda7f3b18967e40e7508097a89e9f2e412384f81e3]",  
"@version": "1",  
"offset": 260054091,  
"tags": [  
"beats\_input\_codec\_plain\_applied"  
],  
"MENSAJE": "tokenHeader: 0ec078efabf7d9694f19e2dda7f3b18967e40e7508097a89e9f2e412384f81e3",  
"zkey": "dataelk",  
"zabbix\_value": "PROD - WSRESTTRAMITES - tokenHeader: 0ec078efabf7d9694f19e2dda7f3b18967e40e7508097a89e9f2e412384f81e3",  
"FECHA": "2018-07-05T21:00:59",  
"CLASE": "c.w.f.TokenFilter",  
"input": {  
"type": "log"  
},  
"APPLICATION": "WSRESTTRAMITES",  
"source": "/var/log/dockerContainers/containers/j8tomcat8\_wsresttramites01/catalina.log",  
"prospector": {  
"type": "log"  
},  
"beat": {  
"name": "kdsflpdock003.kolektor.com.ar",  
"hostname": "kdsflpdock003.kolektor.com.ar",  
"version": "6.3.0"  
},  
"@timestamp": "2018-07-06T00:01:01.659Z",  
"ENV": "PROD"  
}  
}  
]  
}  
}

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 5, 2018, 5:07pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/5 "2018-11-05T17:07:09Z")

</div>

Please format your code, logs or configuration files using `</>` icon as explained in [this guide](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and not the citation button. It will make your post more readable.

Or use markdown style like:

````
```
CODE
```

````

This is the icon to use if you are not using markdown format:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e6e239431ec2d71cbf1beef741f2e93e7cc762c.jpg)

There's a live preview panel for exactly this reasons.

Lots of people read these forums, and many of them will simply skip over a post that is difficult to read, because it's just too large an investment of their time to try and follow a wall of badly formatted text.  
If your goal is to get an answer to your questions, it's in your interest to make it as easy to read and understand as possible.

What is the output of:

```auto
POST docker-2018.07.05/_search?size=0

```

---

<div class="post-metadata">

**Author:** ![Roque\_Moyano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roque_moyano/32/116329_2.png) [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\
**Post date:** [November 5, 2018, 5:21pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/6 "2018-11-05T17:21:22Z")

</div>

sorry , this is the output for size=0

```
  {
  "took": 16,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 3827639,
    "max_score": 0,
    "hits": []
  }
}
```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 5, 2018, 6:39pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/7 "2018-11-05T18:39:44Z")

</div>

So you have 3827639 documents and you want to remove 3827639 documents?

Just drop the index then!

---

<div class="post-metadata">

**Author:** ![Roque\_Moyano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roque_moyano/32/116329_2.png) [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\
**Post date:** [November 5, 2018, 7:43pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/8 "2018-11-05T19:43:47Z")

</div>

I just want to remove the documents where the fields "TIPO" has the value "INFO" , the index has a lot of information that is necessary to keep , for that I can't remove the index.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 5, 2018, 9:09pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/9 "2018-11-05T21:09:28Z")

</div>

DBQ Will remove the documents not only one field.

---

<div class="post-metadata">

**Author:** ![Roque\_Moyano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roque_moyano/32/116329_2.png) [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\
**Post date:** [November 7, 2018, 8:20pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/10 "2018-11-07T20:20:49Z")

</div>

sorry my ignorance , what is DBQ?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 7, 2018, 10:39pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/11 "2018-11-07T22:39:27Z")

</div>

Sorry. **D** elete **B** y **Q** uery

---

<div class="post-metadata">

**Author:** ![Roque\_Moyano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roque_moyano/32/116329_2.png) [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\
**Post date:** [November 8, 2018, 11:51am UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/12 "2018-11-08T11:51:58Z")

</div>

yes but we are in the same step , it fails by timeout , is there any way that I can move some documents to a new index? if do i can remove the index

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [November 8, 2018, 1:52pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/13 "2018-11-08T13:52:16Z")

</div>

Yes. Use reindex API.

But [as I said](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/7?u=dadoonet) if you intend to remove 100% documents, just drop the index.

---

<div class="post-metadata">

**Author:** ![Roque\_Moyano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roque_moyano/32/116329_2.png) [@Roque\_Moyano](https://discuss.elastic.co/u/Roque_Moyano)\
**Post date:** [November 9, 2018, 4:23pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/14 "2018-11-09T16:23:55Z")

</div>

thanks man ! I just move the information that I need to a new index and then remove it.

```
POST /_reindex
    {
      "source": {
        "index": "docker-2018.08.01",
        "query": {
          "match": {
            "TIPO": "ERROR"
          }
        }
      },
      "dest": {
        "index": "docker-errors-2018.08.01"
      }
    }

```

Best Regards!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2018, 4:23pm UTC](https://discuss.elastic.co/t/delete-by-query-gateway-timeout/155430/15 "2018-12-07T16:23:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.