Delete by query via @timestamp

[TechGeek (Chander Mohan)]

I want to delete highlighted doc in image i tried as below:-

Though its deleting all records, please suggest the right command to achieve the Objective.
POST poc/_delete_by_query
{
"query":{
"range":{
"@timestamp":{ "gt" : "2018-05-04T23:04:00Z"}
}
}
}

[val (Val Crettaz)]

@TechGeek

2018-05-04T23:04:00Z

The query is correct, however, June 4th is 2018-06-04T23:04:00Z not 2018-05-04T23:04:00Z

[TechGeek (Chander Mohan)]

@val Thanks for reply...

Still its not deleting the doc with in time range..

[val (Val Crettaz)]

What do you get when running the following query?

POST poc/_search
{
  "query":{
     "range":{
        "@timestamp":{ "gt" : "2018-06-04T23:04:00Z"}
    }
  }
}

[TechGeek (Chander Mohan)]

@val

POST poc/_search { "query":{ "range":{ "@timestamp":{ "gt" : "2018-06-04T23:04:00Z"} } } }

@val.. Here we go...
Seems like I did some silly mistake, though couldn't make it out.

[val (Val Crettaz)]

If you ran that delete by query with 2018-05-04T23:04:00Z then you might have erased all documents from May 4th onwards

[TechGeek (Chander Mohan)]

@val

Mentioning the time range "gt" : "2018-06-04T23:04:00Z", its not deleting the documents.

Can we delete the document based on the HH:MM:SS ?...

[val (Val Crettaz)]

The thing is that there are no documents coming back when searching from June 4th onwards, so my guess is that the documents have been deleted somehow when you were trying to delete from May 4th onwards.

[TechGeek (Chander Mohan)]

@Val ..I got the solution ..

Below highlighted doc stored in local timezone, though command recognize the GMT time zone which is -8hr from HKT.

For the highlighted doc , below is the date has been stored by ELK.