Delete data matching query on Elasticsearch

Elastic Stack Elasticsearch
1

Hi,

I have multiple indexes on ES and I would like to delete some documents matching a particular query.
Index name is like logstash-YYYY.MM.dd and each document has a field named fieldname
I would like to delete all the documents with fieldname equal to 1000

From my understanding, the only way to accomplish this is to use the Delete By Query API (https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html).
Could the following work given the above example?

POST logstash-*/_delete_by_query
{
  "query": { 
    "match": {
      "fieldname": "1000"
    }
  }
}

Thanks

2

Yes. I'd only run that if it about "some documents" and not "many documents". Ie, removing 80% of an index might be less efficient than reindexing 20%...

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.