# Delete by query via @timestamp

**URL:** <https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451>\
**Category:** Elasticsearch\
**Created:** [June 4, 2018, 3:25pm UTC](https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451 "2018-06-04T15:25:36Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![TechGeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/techgeek/32/28158_2.png) [@TechGeek](https://discuss.elastic.co/u/TechGeek)\
**Post date:** [June 4, 2018, 3:25pm UTC](https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451/1 "2018-06-04T15:25:36Z")

</div>

I want to delete highlighted doc in image i tried as below:-

Though its deleting all records, please suggest the right command to achieve the Objective.  
POST poc/\_delete\_by\_query  
{  
"query":{  
"range":{  
"@timestamp":{ "gt" : "2018-05-04T23:04:00Z"}  
}  
}  
}

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/6/766210638a39f0838495b041a6699aa2df6f5105.png)

---

<div class="post-metadata">

**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\
**Post date:** [June 4, 2018, 3:42pm UTC](https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451/2 "2018-06-04T15:42:05Z")

</div>

> [@TechGeek](#):
>
> 2018-05-04T23:04:00Z

The query is correct, however, June 4th is `2018-06-04T23:04:00Z` not `2018-05-04T23:04:00Z`

---

<div class="post-metadata">

**Author:** ![TechGeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/techgeek/32/28158_2.png) [@TechGeek](https://discuss.elastic.co/u/TechGeek)\
**Post date:** [June 4, 2018, 3:57pm UTC](https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451/3 "2018-06-04T15:57:03Z")

</div>

@val Thanks for reply...

Still its not deleting the doc with in time range..

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/1/4105665e8b33ff6c4a847cb28e3d1a7ff62af7cf.png)

---

<div class="post-metadata">

**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\
**Post date:** [June 4, 2018, 3:58pm UTC](https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451/4 "2018-06-04T15:58:48Z")

</div>

What do you get when running the following query?

```
POST poc/_search
{
  "query":{
     "range":{
        "@timestamp":{ "gt" : "2018-06-04T23:04:00Z"}
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![TechGeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/techgeek/32/28158_2.png) [@TechGeek](https://discuss.elastic.co/u/TechGeek)\
**Post date:** [June 4, 2018, 4:02pm UTC](https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451/5 "2018-06-04T16:02:04Z")

</div>

> [@val](#):
>
> POST poc/\_search { "query":{ "range":{ "@timestamp":{ "gt" : "2018-06-04T23:04:00Z"} } } }

@val.. Here we go...  
Seems like I did some silly mistake, though couldn't make it out.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a02d87f1d732370cef6a90e27ee91dbb28ac8ca4.png)

---

<div class="post-metadata">

**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\
**Post date:** [June 4, 2018, 4:06pm UTC](https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451/6 "2018-06-04T16:06:39Z")

</div>

If you ran that delete by query with `2018-05-04T23:04:00Z` then you might have erased all documents from May 4th onwards

---

<div class="post-metadata">

**Author:** ![TechGeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/techgeek/32/28158_2.png) [@TechGeek](https://discuss.elastic.co/u/TechGeek)\
**Post date:** [June 4, 2018, 4:10pm UTC](https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451/7 "2018-06-04T16:10:19Z")

</div>

@val

Mentioning the time range "gt" : "2018-06-04T23:04:00Z", its not deleting the documents.

Can we delete the document based on the HH:MM:SS ?...

---

<div class="post-metadata">

**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\
**Post date:** [June 4, 2018, 4:13pm UTC](https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451/8 "2018-06-04T16:13:30Z")

</div>

The thing is that there are no documents coming back when searching from June 4th onwards, so my guess is that the documents have been deleted somehow when you were trying to delete from May 4th onwards.

---

<div class="post-metadata">

**Author:** ![TechGeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/techgeek/32/28158_2.png) [@TechGeek](https://discuss.elastic.co/u/TechGeek)\
**Post date:** [June 4, 2018, 4:45pm UTC](https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451/9 "2018-06-04T16:45:52Z")

</div>

@Val ..I got the solution ..

Below highlighted doc stored in local timezone, though command recognize the GMT time zone which is -8hr from HKT.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/d/1dd7c29a7068864479a2e356928835e353a6763f.png)

For the highlighted doc , below is the date has been stored by ELK.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/0/d0273039b98aa77136e9a2c4ee19fb8d986dda85.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 2, 2018, 4:46pm UTC](https://discuss.elastic.co/t/delete-by-query-via-timestamp/134451/10 "2018-07-02T16:46:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.