# Delete by query in elasticsearch

**URL:** <https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009>\
**Category:** Elasticsearch\
**Created:** [June 27, 2017, 6:07pm UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009 "2017-06-27T18:07:27Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Post date:** [June 27, 2017, 6:07pm UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/1 "2017-06-27T18:07:28Z")

</div>

Hi,  
I'm using below code to delete my index data using curator. In my version 2.1 elasticsearch working fine but new version its showing some error. Please correct my curl file

```
curl -XDELETE 'http://localhost:9200/logstash-dd.zephyr_log/_delete_by_query ' -d "
{
  "query": 
  {
    "range": 
                {
      "zephyr_timestamp": 
                  { 				  		
				  "gte": \"$from_dataset_date\",
				  "lte": \"$to_dataset_date\"
				  
      }
    }
  }
}"
```

---

<div class="post-metadata">

**Author:** ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)\
**Post date:** [June 28, 2017, 9:01am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/2 "2017-06-28T09:01:10Z")

</div>

The delete by query API has changed since 2.1 and therefore the syntax is a bit different to before. Please see here for details on the new API: [https://www.elastic.co/guide/en/elasticsearch/reference/5.4/docs-delete-by-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.4/docs-delete-by-query.html)

---

<div class="post-metadata">

**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Post date:** [July 3, 2017, 9:16am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/3 "2017-07-03T09:16:16Z")

</div>

Thank for your update.

I have one issue, when i try to install delete by query in my linux machine i'm getting following error,

```
[root@ bin]# cd /usr/share/elasticsearch
[root@ elasticsearch]# sudo bin/elasticsearch-plugin install file:////root/elk/elk_software/delete-by-query-2.2.1.zip
-> Downloading file:////root/elk/elk_software/delete-by-query-2.2.1.zip
[=================================================] 100%  
ERROR: `elasticsearch` directory is missing in the plugin zip
```

---

<div class="post-metadata">

**Author:** ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)\
**Post date:** [July 3, 2017, 10:31am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/4 "2017-07-03T10:31:35Z")

</div>

Make sure that the version of the delete-by-query plugin you are installing matches the exact version of the elasticsearch server. An easier way to make sure the correct plugin version is installed is to run `bin/elasticsearch-plugin install delete-by-query`

---

<div class="post-metadata">

**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Post date:** [July 3, 2017, 10:34am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/5 "2017-07-03T10:34:14Z")

</div>

when i try to install with latest version of delete by query version 2.4.5 even-though i getting same error.

---

<div class="post-metadata">

**Author:** ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)\
**Post date:** [July 3, 2017, 10:35am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/6 "2017-07-03T10:35:26Z")

</div>

What version of Elasticsearch are you running?

---

<div class="post-metadata">

**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Post date:** [July 3, 2017, 10:36am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/7 "2017-07-03T10:36:33Z")

</div>

Elasticsearch version 5.2.1

---

<div class="post-metadata">

**Author:** ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)\
**Post date:** [July 3, 2017, 10:37am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/8 "2017-07-03T10:37:57Z")

</div>

In which case you need to use the 5.2.1 version of delete\_by\_query which is automatically installed with Elasticsearch 5.2.1 so you don't need to separately install a plugin

---

<div class="post-metadata">

**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Post date:** [July 3, 2017, 10:48am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/9 "2017-07-03T10:48:42Z")

</div>

we installed elasticsearch from RPM file and we didn't find any delete by query plugin in plugin folder so that try to install in it

![](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bdf3de9154c1ef71e193441bdc1abdf22e398633.png)

---

<div class="post-metadata">

**Author:** ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)\
**Post date:** [July 3, 2017, 10:50am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/10 "2017-07-03T10:50:45Z")

</div>

plugins that are included by default are stored in modules folder.

---

<div class="post-metadata">

**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Post date:** [July 3, 2017, 10:52am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/11 "2017-07-03T10:52:02Z")

</div>

But in that folder also i could find that plugin name by default if i'm wrong correct me,

![](https://us1.discourse-cdn.com/elastic/original/3X/9/1/91ff73993272327a354f57e1071060dd6a6cec48.png)

---

<div class="post-metadata">

**Author:** ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)\
**Post date:** [July 3, 2017, 10:54am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/12 "2017-07-03T10:54:59Z")

</div>

The 5.2.1 version of delete\_by\_query is included as part of the `reindex` module. Try using the 5.2.1 Delete By Query API as described in [https://www.elastic.co/guide/en/elasticsearch/reference/5.2/docs-delete-by-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.2/docs-delete-by-query.html). It should work

---

<div class="post-metadata">

**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Post date:** [July 5, 2017, 10:09am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/13 "2017-07-05T10:09:57Z")

</div>

HI,  
I'm try to delete few days events from my index and i'm getting error also, please take a look up for my query if any error in code please correct me

```
curl -XPOST 'http://localhost:9200/logstash-dd.zephyr_log/_delete_by_query ' -d "
{
  \"query\": 
  {
    \"range\": 
                {
      \"zephyr_timestamp\": 
                  { 				  		
				 \"gte\": "2017-06-01 00:00:00,000",
				  \"lte\": "2017-06-03 23:59:59,999"
				  
      }
    }
  }
}"
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 2, 2017, 10:10am UTC](https://discuss.elastic.co/t/delete-by-query-in-elasticsearch/91009/14 "2017-08-02T10:10:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
