Need Query for delete last 30 days date

Elastic Stack Elasticsearch
1

Need Query for delete before 30 days date
curl -u userid:password -XDELETE 'http://elasticsearch.*' -d '
{
"query": {
"filtered" : {
"query" : {
},
"filter" : {
"range" : { "@timestamp" : { "lt" : "now-30d" }}
}
}
}
}'

which is delete all data can any one correct this query so that i can delete all old data and remain only last 30 days data

2

What is your elasticsearch version?
Looks like an old one.

3

elasticsearch version - 5.6.1 i hope it is new one

4

You should be using time series indices and deleting those rather than using a delete-by-query.

1 Like
5

I am new for Elastic search could you please help me to correct my below query. my requirement is :- i just one last 30 days data remain rest should delete

curl -u userid:password -XDELETE 'http://elasticsearch.*' -d '
{
"query": {
"filtered" : {
"query" : {
},
"filter" : {
"range" : { "@timestamp" : { "lt" : "now-30d" }}
}
}
}
}'

6

Filtered queries don’t exist anymore since 5.0.
Use a bool filter instead.

And first try with _search endpoint

Then read the delete by query documentation

7

Thanks for reply
I am not aware of bool filter , it will be a very great full help if you could provide me
bool filter script .
i just want to retain last 30 days data and rest all should be deleted

8

Doc here: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html

And again that might be a bad idea running a delete by query.
Specifically if you are going to remove a large number of docs like more than 50% or if you are planning to run that every day.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.