Delete by query not working

Hi all,

I have an index with documents of username : 220987,220388,1218383.

I want to delete all documents with username starting with 22.

So i used below code:

POST /snmp-ser-my-thyalytics-com/_delete_by_query
{
   "query":{
"match":{
"username" : "22*"
	}
}
  
}

It executes the query, gives below output.

{
  "took" : 0,
  "timed_out" : false,
  "total" : 0,
  "deleted" : 0,
  "batches" : 0,
  "version_conflicts" : 0,
  "noops" : 0,
  "retries" : {
    "bulk" : 0,
    "search" : 0
  },
  "throttled_millis" : 0,
  "requests_per_second" : -1.0,
  "throttled_until_millis" : 0,
  "failures" : [ ]
}

but there are no changes.I'm not able to figure out.

It probably depends on the analyzer.

Note that the match query does not support wildcard I believe. May be a wildcard query would be better?

BTW I recommend testing this with a _search before going to the delete by query road.

Hi,

i tested with one of the values it is working:

GET /snmp-ser-my-thyalytics-com/_search
{
  "query": {
    "match": {
      "username": "227095"
    }
  }
}

I am able to see the 4 hits associated with the value.

But when i try to use wildcard username: "22*", there seems to be a problem.

When i try:

GET /snmp-ser-my-thyalytics-com/_search
{
  "query": {
    "match": {
      "username": "22*"
    }
  }
}

I get the following result:

{
  "took" : 0,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 0,
      "relation" : "eq"
    },
    "max_score" : null,
    "hits" : [ ]
  }
}

Any turnaround or convention or way to query for this?

I got it!

After much trial, I got the desired result:

I used prefix instead of match

POST /snmp-ser-my-thyalytics-com/_delete_by_query
{
  "query": {
    "prefix": {
      "username": "23"
    }
  }
}

As I said the match query does not support wildcards but the wildcard query does.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.