# Delete document from index based on log type

**URL:** <https://discuss.elastic.co/t/delete-document-from-index-based-on-log-type/278832>\
**Category:** Elasticsearch\
**Created:** [July 15, 2021, 8:15pm UTC](https://discuss.elastic.co/t/delete-document-from-index-based-on-log-type/278832 "2021-07-15T20:15:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![srk1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srk1/32/88697_2.png) [@srk1](https://discuss.elastic.co/u/srk1)\
**Post date:** [July 15, 2021, 8:15pm UTC](https://discuss.elastic.co/t/delete-document-from-index-based-on-log-type/278832/1 "2021-07-15T20:15:04Z")

</div>

Hello ES users,  
I am trying to explore an option to delete certain type of logs from ES index without deleting the whole index. For example, DEBUG type logs doesn't need to be retained for longer period compared to INFO type logs. Is it possible to delete specific type of logs from an index?

Thanks,  
SRK.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 15, 2021, 8:49pm UTC](https://discuss.elastic.co/t/delete-document-from-index-based-on-log-type/278832/2 "2021-07-15T20:49:48Z")

</div>

Yes, you can do this by using delete by query. This is however quite expensive so you would be better off grouping data into indices based on retention requirements so you can delete complete indices instead.

---

<div class="post-metadata">

**Author:** ![srk1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srk1/32/88697_2.png) [@srk1](https://discuss.elastic.co/u/srk1)\
**Post date:** [July 15, 2021, 9:06pm UTC](https://discuss.elastic.co/t/delete-document-from-index-based-on-log-type/278832/3 "2021-07-15T21:06:32Z")

</div>

Hi, can you please point me to the documentation for deleting by query and you mean resource, time expensive? Can you also explain a bit about the second option?

Thanks,  
SRK.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 12, 2021, 9:06pm UTC](https://discuss.elastic.co/t/delete-document-from-index-based-on-log-type/278832/4 "2021-08-12T21:06:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.