Hi all,
I have an index with documents of username : 220987,220388,1218383.
I want to delete all documents with username starting with 22.
So i used below code:
POST /snmp-ser-my-thyalytics-com/_delete_by_query
{
"query":{
"match":{
"username" : "22*"
}
}
}
It executes the query, gives below output.
{
"took" : 0,
"timed_out" : false,
"total" : 0,
"deleted" : 0,
"batches" : 0,
"version_conflicts" : 0,
"noops" : 0,
"retries" : {
"bulk" : 0,
"search" : 0
},
"throttled_millis" : 0,
"requests_per_second" : -1.0,
"throttled_until_millis" : 0,
"failures" : [ ]
}
but there are no changes.I'm not able to figure out.
dadoonet
(David Pilato)
March 18, 2021, 12:44pm
2
It probably depends on the analyzer.
Note that the match query does not support wildcard I believe. May be a wildcard query would be better?
BTW I recommend testing this with a _search
before going to the delete by query road.
Hi,
i tested with one of the values it is working:
GET /snmp-ser-my-thyalytics-com/_search
{
"query": {
"match": {
"username": "227095"
}
}
}
I am able to see the 4 hits associated with the value.
But when i try to use wildcard username: "22*", there seems to be a problem.
When i try:
GET /snmp-ser-my-thyalytics-com/_search
{
"query": {
"match": {
"username": "22*"
}
}
}
I get the following result:
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 0,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
}
}
Any turnaround or convention or way to query for this?
I got it!
After much trial, I got the desired result:
I used prefix instead of match
POST /snmp-ser-my-thyalytics-com/_delete_by_query
{
"query": {
"prefix": {
"username": "23"
}
}
}
dadoonet
(David Pilato)
March 19, 2021, 3:10am
5
As I said the match
query does not support wildcards but the wildcard
query does.
1 Like
system
(system)
Closed
April 16, 2021, 3:11am
6
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.