# Delete elasticsearch document with logstash-jdbc-input

**URL:** https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490
**Category:** Logstash
**Created:** [April 15, 2016, 9:20am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490 "2016-04-15T09:20:45Z")
**Posts on this page:** 14
**Page:** 1

<div class="post-metadata">

### Author: ![suntuo](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@suntuo](https://discuss.elastic.co/u/suntuo)
#### Post date: [April 15, 2016, 9:20am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/1 "2016-04-15T09:20:45Z")

</div>

Insert and update work with below config file  
but elasticseach has no response as i excute delete-sql on mysql

input {  
jdbc {  
jdbc\_driver\_library =\> "/opt/logstash-2.2.2/mysql-connector-java-5.1.38/mysql-connector-java-5.1.38-bin.jar"  
jdbc\_driver\_class =\> "com.mysql.jdbc.Driver"  
jdbc\_connection\_string =\> "jdbc:mysql://192.168.1.1:3306/databasename"  
jdbc\_user =\> "username"  
jdbc\_password =\> "password"  
schedule =\> "\* \* \* \* \*"  
statement =\> "SELECT \* FROM tablename  
where `tablename`.`update_time` \> :sql\_last\_value"  
use\_column\_value =\> true  
tracking\_column =\> update\_time

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 16, 2016, 8:32pm UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/2 "2016-04-16T20:32:17Z")

</div>

> [@suntuo](#):
>
> but elasticseach has no response as i excute delete-sql on mysql

What does this mean?

All you have shown us is an input, if there is an output that does something in ES it would be useful to see it.

---

<div class="post-metadata">

### Author: ![suntuo](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@suntuo](https://discuss.elastic.co/u/suntuo)
#### Post date: [April 18, 2016, 2:21am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/3 "2016-04-18T02:21:24Z")

</div>

output{  
elasticsearch {  
hosts =\> ["192.168.1.1:9200"]  
index =\> "index\_tablename"  
document\_id =\> "%{id}" }  
}

With the option : document\_id =\> "%{id}"  
The existing entries in Elasticsearch with the same ID will be overwrite when i update data on mysql.  
but when i delete data form mysql, those ES entries won't be removed.  
How can i remove those old data in ES which have been deleted on mysql.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 18, 2016, 2:36am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/4 "2016-04-18T02:36:36Z")

</div>

You can't it's only an update/insert process.  
I'm not sure how you can get around this.

---

<div class="post-metadata">

### Author: ![suntuo](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@suntuo](https://discuss.elastic.co/u/suntuo)
#### Post date: [April 18, 2016, 2:54am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/5 "2016-04-18T02:54:04Z")

</div>

Thanks

---

<div class="post-metadata">

### Author: ![laoyang360](https://avatars.discourse-cdn.com/v4/letter/l/a9a28c/32.png) [@laoyang360](https://discuss.elastic.co/u/laoyang360)
#### Post date: [June 22, 2016, 8:53am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/6 "2016-06-22T08:53:11Z")

</div>

I also have this problem, But I don't know how to resolve it?  
Any help would be sincerely appreciate!

---

<div class="post-metadata">

### Author: ![suntuo](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@suntuo](https://discuss.elastic.co/u/suntuo)
#### Post date: [June 22, 2016, 10:15am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/7 "2016-06-22T10:15:12Z")

</div>

You can add a "status" column, and flag the entry as deleted, instead of deleting the entry.

---

<div class="post-metadata">

### Author: ![laoyang360](https://avatars.discourse-cdn.com/v4/letter/l/a9a28c/32.png) [@laoyang360](https://discuss.elastic.co/u/laoyang360)
#### Post date: [June 23, 2016, 1:23am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/8 "2016-06-23T01:23:34Z")

</div>

> [@suntuo](#):
>
> where tablename.update\_time \> :sql\_last\_value"

thank you!  
I have one question about what you said above:  
when I use sql like above  
"where tablename.update\_time \> :sql\_last\_value"

The below bug appeard:  
Exception when executing JDBC query {:exception=\>#\<Sequel::DatabaseError: Java::ComMysqlJdbcExceptionsJdbc4::MySQLSyntaxErrorException: Unknown column 'cc.update\_time' in 'where clause'\>, :level=\>:warn}  
Java::ComMysqlJdbcExceptionsJdbc4::MySQLSyntaxErrorException: Unknown column 'cc.update\_time' in 'where clause': SELECT count(\*) AS `count` FROM (select  
\*  
cc is my table name, update\_time is not exist, can you help me?  
thanks !

---

<div class="post-metadata">

### Author: ![laoyang360](https://avatars.discourse-cdn.com/v4/letter/l/a9a28c/32.png) [@laoyang360](https://discuss.elastic.co/u/laoyang360)
#### Post date: [June 23, 2016, 1:52am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/9 "2016-06-23T01:52:57Z")

</div>

First, you know, In mysql we just use delete from \* to delete some date we don't use.  
Second, We want to sync the delete information, as you say, "add a "status" column", what you say is 🙂

1. in mysql, just add a status column to indetify the date is ok or not, just like:  
mysql\> select \* from cc;  
+----+--------------------+--------+  
| id | name | status |  
+----+--------------------+--------+  
| 1 | laoyang360 | ok |  
| 4 | intok | ok |  
| 5 | jdbc\_test\_update08 | ok |  
| 7 | test7 | ok |  
| 8 | test008 | ok |  
| 9 | test9 | ok |  
| 10 | test10 | ok |  
+----+--------------------+--------+  
7 rows in set (0.00 sec)

mysql\>  
mysql\>  
mysql\> update cc set status = 'deleted' where id = 10;  
Query OK, 1 row affected (0.02 sec)  
Rows matched: 1 Changed: 1 Warnings: 0

mysql\> select \* from cc;  
+----+--------------------+---------+  
| id | name | status |  
+----+--------------------+---------+  
| 1 | laoyang360 | ok |  
| 4 | intok | ok |  
| 5 | jdbc\_test\_update08 | ok |  
| 7 | test7 | ok |  
| 8 | test008 | ok |  
| 9 | test9 | ok |  
| 10 | test10 | deleted |  
+----+--------------------+---------+  
7 rows in set (0.00 sec)

[2.In](http://2.In) elasticsearch, revise the data status, I think in elasticsearch revise is very difficult.

I want to listen your advise,

---

<div class="post-metadata">

### Author: ![suntuo](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@suntuo](https://discuss.elastic.co/u/suntuo)
#### Post date: [June 23, 2016, 2:12am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/10 "2016-06-23T02:12:49Z")

</div>

> [@suntuo](#):
>
> The existing entries in Elasticsearch with the same ID will be overwrite when i update data on mysql.

you can add a timestamp column, as you modify the status the timestamp value will be updated, Using paramter tablename.timestamp \> :sql\_last\_value", logstash will only update the entry which timestamp has been updated.

---

<div class="post-metadata">

### Author: ![laoyang360](https://avatars.discourse-cdn.com/v4/letter/l/a9a28c/32.png) [@laoyang360](https://discuss.elastic.co/u/laoyang360)
#### Post date: [June 23, 2016, 4:10am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/11 "2016-06-23T04:10:55Z")

</div>

Thanks. I already added timestamp column named modified\_at, just like:  
mysql\> select \* from cc;  
+----+--------------------+---------+---------------------+  
| id | name | status | modified\_at |  
+----+--------------------+---------+---------------------+  
| 10 | test10 | deleted | 0000-00-00 00:00:00 |  
| 11 | test1111 | ok | 2016-06-23 04:10:00 |  
| 12 | test012 | ok | 2016-06-23 04:21:56 |  
+----+--------------------+---------+---------------------+

and the sql is 🙂  
[root@5b9dbaaa148a logstash\_jdbc\_test]# cat jdbc.sql  
select  
\*  
from  
cc  
where cc.modified\_at \> :sql\_last\_value

and the result is  
{"id":11,"name":"test1111","status":"ok","modified\_at":"2016-06-23T03:10:00.000Z","@version":"1","@timestamp":"2016-06-23T04:10:00.185Z","type":"cc\_type"}  
{"id":12,"name":"test012","status":"ok","modified\_at":"2016-06-23T03:21:56.000Z","@version":"1","@timestamp":"2016-06-23T04:10:00.187Z","type":"cc\_type"}

---

<div class="post-metadata">

### Author: ![chrisribe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisribe/32/22398_2.png) [@chrisribe](https://discuss.elastic.co/u/chrisribe)
#### Post date: [January 18, 2017, 8:47pm UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/12 "2017-01-18T20:47:25Z")

</div>

Hi,

I get that you need to flag / log the delete operation and I get that done via triggers in mysql.  
But how can I instruct the logstash-jdbc-input plugin to delete the given document ids ??

Seems a simple task for the plugin no?  
Thanks  
Chris

---

<div class="post-metadata">

### Author: ![suntuo](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@suntuo](https://discuss.elastic.co/u/suntuo)
#### Post date: [January 19, 2017, 1:43am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/13 "2017-01-19T01:43:48Z")

</div>

> [@warkolm](#):
>
> You can't it's only an update/insert process.

You can add a "status" column, and flag the entry as deleted, instead of deleting the entry.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:29am UTC](https://discuss.elastic.co/t/delete-elasticsearch-document-with-logstash-jdbc-input/47490/14 "2017-07-06T04:29:17Z")

</div>


