Delete By query On Fields of type Text

Elastic Stack Elasticsearch
1

Elasticsearch Version: 8.7.1

We needed to do some deletes by Query using: Delete by query API | Elasticsearch Guide [8.7] | Elastic

Our Request using dev tools on Kibana:

POST /INDEX/_delete_by_query
{
  "query": {
      "match": {
      "context.label": "TEST 111111-1"
    }
  }
}

This query deleted all documents with the substring: "TEST". And not only the exact match: "TEST 111111-1".
We used this request before and only deleted exact matches!
Can you help us understand our error or if this is a major bug on this version?

2

My guess is that the field you are running the query against is mapped as text, which means that the text is tokenised. If you ran it against a field mapped as keyword it would have behaved as you described.

If the mappings are as described what you are seeing is expected. If you are going to run a one-off DBQ I would recommend to always run the query separately and verify that it matches what you expect.

1 Like
3

I can confirm that type of the field is text.

How can I update a field of the type text only on exact matches?

Thanks you for the clarification!

4

You can generally not update mappings without reindexing. If you are using dynamic mappings there may be a subfield named context.label.keyword mapped as keyword that you can use.

5

For this field, I do not have a keyword option.

So if I understood correctly I would need to reindex this index to add a keyword field?

Notes:
If I try to update or delete docs filtering using queries I should always use the fields with ".keyword" If I do not use this it would update or delete using the substrings of the filter.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.