Deleting a specific document in an index

Elastic Stack Elasticsearch
#1

I generated 2 documents with the following curl command:

curl -XPOST 'http://PICDSM020001125.intranet.barcapint.com:9200/stuckthreads/detail?pretty' -d '
{
"date":"2016-09-09T14:00:00",
"environment":"UAT3",
"slotCount":1,
"slotAverage":292,
"maxCount":0,
"maxAverage":0
}'
curl -XPOST 'http://PICDSM020001125.intranet.barcapint.com:9200/stuckthreads/detail?pretty' -d '
{
"date":"2016-09-09T14:00:00",
"environment":"STAGE",
"slotCount":1,
"slotAverage":352,
"maxCount":0,
"maxAverage":0
}'

I then deleted the first document with the following command:
curl -XDELETE 'http://PICDSM020001125.intranet.barcapint.com:9200/stuckthreads/_query' -d '
{
"query" : {
"term" : {
"date" : "2016-09-09T14:00:00",
"environment":"UAT3"
}
}
}'

but both the documents got deleted. Is there something I am doing wrong?

#2

try
curl -XPOST 'http://PICDSM020001125.intranet.barcapint.com:9200/stuckthreads/1
{......}
curl -XPOST 'http://PICDSM020001125.intranet.barcapint.com:9200/stuckthreads/2
{....}
for example
PUT /index_name/type/1
{
"@timestamp" : "2016-09-12",
"value": 9999.01
}

#3

well when I do a get I see 2 hits i.e. two documents.

10:03:07/nypntdev@nykdsr5838:~/logs/kibana_stuck_threads/tmp]$ curl -i -XGET 'http://PICDSM020001125.intranet.barcapint.com:9200/stuckthreads/_search?pretty'
HTTP/1.1 200 OK
Content-Type: application/json; charset=UTF-8
Content-Length: 745
Proxy-Connection: Keep-Alive
Connection: Keep-Alive
Date: Mon, 12 Sep 2016 14:03:10 GMT

{
"took" : 1,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 2,
"max_score" : 1.0,
"hits" : [ {
"_index" : "stuckthreads",
"_type" : "detail",
"_id" : "AVcetWmaZZ3pMcf82Xd2",
"_score" : 1.0,
"_source":
{
"date":"2016-09-09T14:00:00",
"environment":"STAGE",
"slotCount":1,
"slotAverage":352,
"maxCount":0,
"maxAverage":0
}
}, {
"_index" : "stuckthreads",
"_type" : "detail",
"_id" : "AVcetWmLZZ3pMcf82Xd1",
"_score" : 1.0,
"_source":
{
"date":"2016-09-09T14:00:00",
"environment":"UAT3",
"slotCount":1,
"slotAverage":292,
"maxCount":0,
"maxAverage":0
}
} ]
}
}

#4

so - is it using date as a key to the document? is there a way I can use date and environment as the key so the delete will only work on that document?

#5

[quote="Shailen, post:3, topic:60299"]
delete by id[/quote]
try DELETE /stuckthreads/detail/AVcetWmaZZ3pMcf82Xd2

my example DELETE logstash-2016.09.12/fluentd/AVcet4k90SCsdvTqOSgO is OK

#6

here is the problem with that approach. I don't know the id I want to delete in advance since it is auto-generated. I only the date and environment.

#7

can someone please help with an alternate solution?

#8

after trying a couple of options, the following command worked:

curl -XDELETE 'http://PICDSM020001125.intranet.barcapint.com:9200/stuckthreads/_query?q=%2Bdate%3A"2016-09-09T14:00:00"+%2Benvironment%3A"UAT3"'

#9