# Elastic API query \_grokparsefailure tags **URL:** \ **Category:** Elasticsearch\ **Created:** [August 3, 2020, 1:38pm UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584 "2020-08-03T13:38:29Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![alces](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alces/32/58340_2.png) [@alces](https://discuss.elastic.co/u/alces)\ **Post date:** [August 3, 2020, 1:38pm UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584/1 "2020-08-03T13:38:29Z")
Hello, I'm currently trying to get all logs of an index which have a "\_grokparsefailure" tag assigned to it. Next step would be deleting these logs, but I'm not sure if this is going to work anyways: ```auto curl -X GET "http:-------------:PORT/_mget?pretty" -H 'Content-Type: application/json' -d' { "docs": [ { "_index": "system_syslog-2020.08.03", "_type": "_doc", "_source.tags": [ "_grokparsefailure" ] } ] } ' ``` This doesn't work but it's more or less what I have been trying with. Is \_mget the correct approach? Or is get or msearch better? How can I get access to the "tags"? ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [August 3, 2020, 1:48pm UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584/2 "2020-08-03T13:48:26Z")
How are you ingesting the data? With Logstash you would do something like this in the filter. ```auto if [tags] !~ "_grokparsefailure" { drop { } } ``` ---
**Author:** ![alces](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alces/32/58340_2.png) [@alces](https://discuss.elastic.co/u/alces)\ **Post date:** [August 3, 2020, 2:04pm UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584/3 "2020-08-03T14:04:19Z")
Im searching for a way to query elasticsearch, not to change my logstash pipeline. Or am I missing something? ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [August 3, 2020, 2:21pm UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584/4 "2020-08-03T14:21:20Z")
Didn't test this but I would try a delete by query. > **[Delete documents | Elasticsearch API documentation](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-delete-by-query)** > > Deletes documents that match the specified query. > If the Elasticsearch security features are enabled, you must have the following index privileges for the target data stream, in... ```auto POST /my-index-000001/_delete_by_query { "query": { "match": { "_source.tags": "_grokparsefailure" } } } ``` Something like that. ---
**Author:** ![alces](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alces/32/58340_2.png) [@alces](https://discuss.elastic.co/u/alces)\ **Post date:** [August 4, 2020, 7:43am UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584/5 "2020-08-04T07:43:13Z")
I read about \_delete\_by\_query, this was my plan deleting the logs. But is there a way I can get the logs and look at them before I'm going to delete them? I'm thinking of a scenario in the future where I have to delete some specific logs and I want to look at them first. Ideally this query would be in the same format as the \_delete\_by\_query. ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [August 4, 2020, 1:29pm UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584/6 "2020-08-04T13:29:31Z")
Change `_delete_by_query` to `_search` and `POST` to `GET` until it produces the results you want to delete. ---
**Author:** ![alces](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alces/32/58340_2.png) [@alces](https://discuss.elastic.co/u/alces)\ **Post date:** [August 5, 2020, 12:49pm UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584/7 "2020-08-05T12:49:24Z")
I tried with some like the following: ```auto curl -X GET "http://some-host:some-port/some-index/_search?pretty" -H 'Content-Type: application/json' -d' { "query": { "match": { "_source.tags": "_grokparsefailure" } } } ' ``` But I still get everything within the specified index, not only the matching ones the query should give me. I also tried with a custom/temporary index using the `_delete_by_query `and it deleted the whole index instead of only the matching ones. Also the search output is only like 5 or 6 logs and not all. I think I'm missing something very essential here. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [August 5, 2020, 1:13pm UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584/8 "2020-08-05T13:13:14Z")
Would that work? ```auto GET /some-index/_search { "query": { "term": { "tags": "_grokparsefailure" } } } ``` Or depending on your mapping: ```auto GET /some-index/_search { "query": { "term": { "tags.keyword": "_grokparsefailure" } } } ``` ---
**Author:** ![alces](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alces/32/58340_2.png) [@alces](https://discuss.elastic.co/u/alces)\ **Post date:** [August 7, 2020, 9:21am UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584/9 "2020-08-07T09:21:12Z")
Solved: I had trouble with two issues: 1. the whole temporary index got deleted and searched because i didn't know i had to escape '/' and the standard matching is an 'OR' instead of 'AND' so something like this will work on paths etc. ```auto GET /some-index/_search { "query": { "match": { "log.file.path": { "query": "\\/var\\/log\\/secure", "operator": "and" } } } } ``` 1. my search didn't get me the correct numbers because they are simply limited, so i needed to use `"track_total_hits": true,` to get the correct value: ```auto GET /some-index/_search { "track_total_hits": true, "query": { "term": { "tags": "_grokparsefailure" } } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 4, 2020, 9:21am UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584/10 "2020-09-04T09:21:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.