Delete data matching query on Elasticsearch


I have multiple indexes on ES and I would like to delete some documents matching a particular query.
Index name is like logstash-YYYY.MM.dd and each document has a field named fieldname
I would like to delete all the documents with fieldname equal to 1000

From my understanding, the only way to accomplish this is to use the Delete By Query API (
Could the following work given the above example?

POST logstash-*/_delete_by_query
  "query": { 
    "match": {
      "fieldname": "1000"


Yes. I'd only run that if it about "some documents" and not "many documents". Ie, removing 80% of an index might be less efficient than reindexing 20%...

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.