# Delete document in elastic in ingest based on condition

**URL:** https://discuss.elastic.co/t/delete-document-in-elastic-in-ingest-based-on-condition/110838
**Category:** Elasticsearch
**Created:** [December 8, 2017, 12:00pm UTC](https://discuss.elastic.co/t/delete-document-in-elastic-in-ingest-based-on-condition/110838 "2017-12-08T12:00:30Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![vivekthangathurai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivekthangathurai/32/23561_2.png) [@vivekthangathurai](https://discuss.elastic.co/u/vivekthangathurai)
#### Post date: [December 8, 2017, 12:00pm UTC](https://discuss.elastic.co/t/delete-document-in-elastic-in-ingest-based-on-condition/110838/1 "2017-12-08T12:00:31Z")

</div>

my requirement is that I need to drop the records which are matching a condition. I am able to delete the records once it is indexed. but i would like to delete the documents using the ingest pipeline or filebeat filter.

POST my\_index/\_delete\_by\_query  
{  
"query": {  
"bool": {  
"must\_not": {  
"exists": {  
"field": "testid"  
}  
}  
}  
}  
}

I need the script something like below to delete document based on a condition.

{ "description" : "testing",  
"processors": [ {  
{ "script": { "lang": "painless", "inline": "delete document here"}  
}  
}]  
}

---

<div class="post-metadata">

### Author: ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)
#### Post date: [December 10, 2017, 2:20pm UTC](https://discuss.elastic.co/t/delete-document-in-elastic-in-ingest-based-on-condition/110838/2 "2017-12-10T14:20:14Z")

</div>

Filebeat and ingest pipeline are data ingestion components and they can't be used to delete documents.

Is this a case that your application logs when a document is deleted?

---

<div class="post-metadata">

### Author: ![vivekthangathurai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivekthangathurai/32/23561_2.png) [@vivekthangathurai](https://discuss.elastic.co/u/vivekthangathurai)
#### Post date: [December 11, 2017, 6:33am UTC](https://discuss.elastic.co/t/delete-document-in-elastic-in-ingest-based-on-condition/110838/3 "2017-12-11T06:33:39Z")

</div>

Using filebeat i was able to drop events based on filter conditions  
[https://www.elastic.co/guide/en/beats/filebeat/master/drop-event.html](https://www.elastic.co/guide/en/beats/filebeat/master/drop-event.html)  
is it possible to do the same for case where if a field does not exist, drop the event?

I understood that using ingest we can modify the documents. is there way to drop that doc?

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [December 11, 2017, 6:47am UTC](https://discuss.elastic.co/t/delete-document-in-elastic-in-ingest-based-on-condition/110838/4 "2017-12-11T06:47:20Z")

</div>

It sadly does not exist yet in ingest. See

> <https://github.com/elastic/elasticsearch/issues/23726>

---

<div class="post-metadata">

### Author: ![vivekthangathurai](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vivekthangathurai/32/23561_2.png) [@vivekthangathurai](https://discuss.elastic.co/u/vivekthangathurai)
#### Post date: [December 11, 2017, 10:47am UTC](https://discuss.elastic.co/t/delete-document-in-elastic-in-ingest-based-on-condition/110838/5 "2017-12-11T10:47:59Z")

</div>

Thanks @dadoonet

I could not really understand the workaround given in the issue using the on\_failure. how can i work around the issue?

is there no way to do it?

-Vivek

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [December 11, 2017, 2:34pm UTC](https://discuss.elastic.co/t/delete-document-in-elastic-in-ingest-based-on-condition/110838/6 "2017-12-11T14:34:14Z")

</div>

I don't recall a real workaround for now for the use case you mentioned. But may be @talevy has an idea?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 8, 2018, 2:34pm UTC](https://discuss.elastic.co/t/delete-document-in-elastic-in-ingest-based-on-condition/110838/7 "2018-01-08T14:34:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
