# How to delete before 24 hours elasticsearch document

**URL:** https://discuss.elastic.co/t/how-to-delete-before-24-hours-elasticsearch-document/118799
**Category:** Elasticsearch
**Created:** [February 7, 2018, 10:11am UTC](https://discuss.elastic.co/t/how-to-delete-before-24-hours-elasticsearch-document/118799 "2018-02-07T10:11:57Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)
#### Post date: [February 7, 2018, 10:11am UTC](https://discuss.elastic.co/t/how-to-delete-before-24-hours-elasticsearch-document/118799/1 "2018-02-07T10:11:57Z")

</div>

hello  
Im would delete **before 24 hours** elasticsearch document  
And put this inside the cron  
what is the query " delete before 24 hours elasticsearch document" ??

---

<div class="post-metadata">

### Author: ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)
#### Post date: [February 7, 2018, 10:47am UTC](https://discuss.elastic.co/t/how-to-delete-before-24-hours-elasticsearch-document/118799/2 "2018-02-07T10:47:16Z")

</div>

my elk server received log from 4 nginx server,  
I just want to keep logs 24 hours in advance,  
And the rest of it will be erased

---

<div class="post-metadata">

### Author: ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)
#### Post date: [February 7, 2018, 10:53am UTC](https://discuss.elastic.co/t/how-to-delete-before-24-hours-elasticsearch-document/118799/3 "2018-02-07T10:53:36Z")

</div>

```
curl -XDELETE 'http://localhost:9200/filebeat-2018.02.07/_query' -d '
{
  "query": {
    "filtered" : {
      "query" : {
        "term" : { "termName" : "termValue" }
      },
      "filter" : {
        "range" : { "@timestamp" : { "lt" : "now-30d" }}
      }
    }
  }
}'

```

Something like that

---

<div class="post-metadata">

### Author: ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)
#### Post date: [February 8, 2018, 7:52am UTC](https://discuss.elastic.co/t/how-to-delete-before-24-hours-elasticsearch-document/118799/4 "2018-02-08T07:52:04Z")

</div>

**Why does not someone answer?**

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [February 8, 2018, 8:05am UTC](https://discuss.elastic.co/t/how-to-delete-before-24-hours-elasticsearch-document/118799/5 "2018-02-08T08:05:09Z")

</div>

Read [this](https://discuss.elastic.co/t/about-the-elasticsearch-category/21) and specifically the "Also be patient" part.

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [February 8, 2018, 8:07am UTC](https://discuss.elastic.co/t/how-to-delete-before-24-hours-elasticsearch-document/118799/6 "2018-02-08T08:07:18Z")

</div>

Here is the documentation for the delete by query: [https://www.elastic.co/guide/en/elasticsearch/reference/6.2/docs-delete-by-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/docs-delete-by-query.html)

---

<div class="post-metadata">

### Author: ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)
#### Post date: [February 8, 2018, 2:20pm UTC](https://discuss.elastic.co/t/how-to-delete-before-24-hours-elasticsearch-document/118799/7 "2018-02-08T14:20:23Z")

</div>

Thankful  
I solved the problem using this command

`curator_cli --host 127.0.0.1 --timeout 300 --port 9200 --http_auth elastic:changeme delete_indices --filter_list '[{"filtertype":"age", "source":"name", "direction":"older", "unit":"days", "unit_count":1, "timestring":"%Y.%m.%d"}]'`

I just want to put this command inside the **cron** or **crontab**??

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 8, 2018, 2:20pm UTC](https://discuss.elastic.co/t/how-to-delete-before-24-hours-elasticsearch-document/118799/8 "2018-03-08T14:20:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
