# Deleting Events From Frozen Data Tier

**URL:** <https://discuss.elastic.co/t/deleting-events-from-frozen-data-tier/345395>\
**Category:** Elasticsearch\
**Created:** [October 19, 2023, 1:50pm UTC](https://discuss.elastic.co/t/deleting-events-from-frozen-data-tier/345395 "2023-10-19T13:50:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [October 19, 2023, 1:50pm UTC](https://discuss.elastic.co/t/deleting-events-from-frozen-data-tier/345395/1 "2023-10-19T13:50:57Z")

</div>

Attempting to delete by query events in a frozen data tier index belonging to a data stream. I've tried targeting the specific index the events are in as well as the datastream name, but I get the following error:

```auto
{
        "index": "partial.contoso-2023.10.19-000147",
        "id": "eoERR4sBzZCF6uPiMLfR",
        "cause": {
          "type": "cluster_block_exception",
          "reason": "index [partial.contoso-2023.10.19-000147] blocked by: [FORBIDDEN/8/index write (api)];"
        },
        "status": 403
      }

```

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [October 19, 2023, 2:02pm UTC](https://discuss.elastic.co/t/deleting-events-from-frozen-data-tier/345395/2 "2023-10-19T14:02:04Z")

</div>

For this to work, you will need to remount the index without write blocked.  
This is by design as cold and frozen are meant as archival (read only).

If you really need to remove the data, my approach would be to reindex the data by query (excluding the data you need to remove) and then delete the source index.

---

<div class="post-metadata">

**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Post date:** [October 19, 2023, 3:09pm UTC](https://discuss.elastic.co/t/deleting-events-from-frozen-data-tier/345395/3 "2023-10-19T15:09:13Z")

</div>

Thanks @sholzhauer! Mind double-checking my work, will the source index still be picked up properly by the data stream? My query should exclude all documents where the field `data_origin` is `contoso-2023.09.22-000983`

```auto
POST _reindex?wait_for_completion=false
{
  "source": {
    "index": "partial-.contoso-2023.09.13-000983",
    "query": {
      "bool": {
        "must_not":{
          "match":{
            "data_origin": "contoso-2023.09.22-000983"
          }
        }
      }
    }
  },
  "dest": {
    "index": ".ds.contoso-2023.09.22-000983-reindex",
     "op_type": "create"
  }
}

```

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [October 20, 2023, 6:50am UTC](https://discuss.elastic.co/t/deleting-events-from-frozen-data-tier/345395/4 "2023-10-20T06:50:17Z")

</div>

> will the source index still be picked up properly by the data stream

If you are referring to the Data View in kibana, then yes it should be picked up.  
But it will not be a part of the same datastream.

If you want it to be a part of the same datastream you should replace your `dest` configuration with the datastream name.

```json
{
    "dest": {
        "index": "contoso",
        "op_type": "create"
    }
}

```

> My query should exclude all documents where the field `data_origin` is `contoso-2023.09.22-000983`

Then yes your query looks to be doing precisely that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2023, 6:50am UTC](https://discuss.elastic.co/t/deleting-events-from-frozen-data-tier/345395/5 "2023-11-17T06:50:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.