# Delete\_by\_query increases the storage size

**URL:** https://discuss.elastic.co/t/delete-by-query-increases-the-storage-size/273806
**Category:** Elasticsearch
**Created:** [May 24, 2021, 9:50am UTC](https://discuss.elastic.co/t/delete-by-query-increases-the-storage-size/273806 "2021-05-24T09:50:50Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)
#### Post date: [May 24, 2021, 9:50am UTC](https://discuss.elastic.co/t/delete-by-query-increases-the-storage-size/273806/1 "2021-05-24T09:50:50Z")

</div>

Hi All,

I have used following "delete\_by\_query" to delete large number of documents from an index of my ES.

```
POST /winlogbeat-7.12.0-2021.05.20-000029/_delete_by_query
{
  "query": {
    "match": {
      "event.code": "5157"
    }
  }
}

```

The first thing I noticed is, the delete operation is taking long time to delete the documents.

Apart from that I have noticed, the size of the index is increasing though the document count reduces.  
The intention of the delete operation was to free the storage by removing less important logs.  
Can someone please let me know why this is happening and guide me to free the space correctly.

Thanks  
Billz1026

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 24, 2021, 10:05am UTC](https://discuss.elastic.co/t/delete-by-query-increases-the-storage-size/273806/2 "2021-05-24T10:05:57Z")

</div>

Elasticsearch shards use immutable segments for storing data so when you delete a document you create a tombstone record, but the documents are not physically deleted until the underlying segments are merged.

---

<div class="post-metadata">

### Author: ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)
#### Post date: [May 24, 2021, 10:16am UTC](https://discuss.elastic.co/t/delete-by-query-increases-the-storage-size/273806/3 "2021-05-24T10:16:35Z")

</div>

Hi Christian,

Thanks for the reply. after bit reading I found that I have to run "forcemerge" to free the space. Can you please let me know whether I am in the correct path?

BR,  
Billz1026

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 24, 2021, 10:21am UTC](https://discuss.elastic.co/t/delete-by-query-increases-the-storage-size/273806/4 "2021-05-24T10:21:00Z")

</div>

Yes that is correct.

---

<div class="post-metadata">

### Author: ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)
#### Post date: [May 24, 2021, 10:22am UTC](https://discuss.elastic.co/t/delete-by-query-increases-the-storage-size/273806/5 "2021-05-24T10:22:13Z")

</div>

> [@Christian\_Dahlqvist](#):
>
> segments are merged.

Thanks Christian

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 21, 2021, 10:23am UTC](https://discuss.elastic.co/t/delete-by-query-increases-the-storage-size/273806/6 "2021-06-21T10:23:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.