Delete file from index with _delete_by_query empties the index

Elastic Stack Elasticsearch
1

I've tried to delete one of the imported files (csv logstash import) from my index by using:

POST /myindex/_delete_by_query
{
"query": {
"match": {
"path": "filename.ext"
}
}
}

My intention was to delete only the documents related to the filename.ext import from myindex.

The action caused the complete index to be empty. Am I misinterpreting this statement?

2

It depends on the analyzer, mapping how you exactly run it, if by mistake you put a blank line between the POST line and the json body.

Could you provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

3

Sorry for not formatting my code correctly.

POST /myindexname/_delete_by_query 
{
"query": {
"match": {
"path": "c:/myinputpath/MyCSVFile20200125.log"
}
}
}
4

I'd I try to execute your code, it will tell me that the index does not exist.
It's not a full reproduction script.

5

Thanks for your reaction. Sorry, I don't understand what you mean.
This is an index on my system, so why do you expect the index to exist?

I've just retried to delete the document of only one imported file. Tried without the directory but only with the filename, but again I ended up with a complete empty index.

6

Because I asked for this:

7

I've found another way to do it:

POST /myindexname/_delete_by_query?q=path:"MyCSVFile20200125.log"

works perfect!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.