How to delete a field completely from an index

Elastic Stack Elasticsearch
1

I created some field in the past for testing. Let's take the "STATISTIC-PROCESS-RUNTIME-HOUR" as an example.

So I was able to find a way to remove that field from my index with:

POST filebeat-7.13.0-2021.05.26-000001/_delete_by_query
{
  "query": {
    "exists": { "field": "STATISTIC-PROCESS-RUNTIME-HOUR" }
  }
}

It found the entries and actually deleted them.

And when I now search for it with:

POST _search
{
  "size": 1,
  "query": {
    "exists": { "field": "STATISTIC-PROCESS-RUNTIME-HOUR" }
  }
}

it does not find anything anymore.

So far so good. But it is still in the Index Patterns

grafik
grafik1126×484 39.6 KB

How comes?

So how do I properly delete that field?

Btw I for sure refreshed the index, but that didn't change anything

grafik

2

There is no way to delete a field from mapping. Even if you delete all documents that contain this field, this field would still be present in mapping and this is where Kibana gets its field suggestions from.

1 Like
3

But what did my command do then?

Ok then the question is how to delete docs with those fields?

And another additional question. When I have a field with multiple types, how can a then make sure the field only has one type?

4

You need to map carefully when you upload many indices so that there is no clash of field types.
So you should re-upload these indices and map correctly while uploading.If you dont mind mapping type conflict, you can continue.

5

If you want to delete all the documents that have the field, you should use a "exist" query and "Delete by query":

6

The only way to remove the field is to run a reindex into a new index, making sure you don't carry that field over.

2 Likes
7

But look, that is exactly what I did.

Ok so the only way is a reindex. But I tried to reindex already and it failed due to memory lack I think. Is there something else I can do now?

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.