Delete By Query Not Working

Elastic Stack Elasticsearch
1

I have a field that frequently has the value of :. I'm trying to delete all of these entries using the below.

POST /index/_delete_by_query
{
  "query": {
    "match": {
        "log.message": ":"
    }
  }
}

Using dev tools, it seems to run successfully.

{
  "took": 0,
  "timed_out": false,
  "total": 0,
  "deleted": 0,
  "batches": 0,
  "version_conflicts": 0,
  "noops": 0,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "requests_per_second": -1,
  "throttled_until_millis": 0,
  "failures": []
}

But then when I check the index, entries still exist.

image

2

Hi @wwalker

Probably your text field is using the "standard" analyzer and that's why there is no token.
Try using the keyword field:

{
  "query": {
    "match": {
        "log.message.keyword": ":"
    }
  }
}
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.