# Negative TTL records purging

**URL:** <https://discuss.elastic.co/t/negative-ttl-records-purging/66037>\
**Category:** Elasticsearch\
**Created:** [November 14, 2016, 11:16pm UTC](https://discuss.elastic.co/t/negative-ttl-records-purging/66037 "2016-11-14T23:16:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![phoenix.s58](https://avatars.discourse-cdn.com/v4/letter/p/3e96dc/32.png) [@phoenix.s58](https://discuss.elastic.co/u/phoenix.s58)\
**Post date:** [November 14, 2016, 11:16pm UTC](https://discuss.elastic.co/t/negative-ttl-records-purging/66037/1 "2016-11-14T23:16:54Z")

</div>

I am running into an issue after a recent cluster crash, for which i had to restart nodes that contained around 170 gb of data.

TTL of all records are set to 15 days through index mapping. I notice now that after weeks of restoring data after that crash, a lot of negative TTL records exists growing the size of data to ~300 GB. I have a query that filters out such records with time of event \< a specific data (that’s 15 days before current date) and i see quite a high negative TTL on them.

Issue:

I need to delete them even if TTL is not kicking in well since it’s non-deterministic on ES anyway. i used -XDELETE and on 2.3 it seems to have been decommissioned, so i was trying to use \_delete\_by\_query plugin:

Command:

curl -XPOST 'http://:9200//\_delete\_by\_query' -d '{  
"query": {"filtered": {"filter": {"and": [{ "range": {"eventtime": {"gte": 0,"lte": 1477621495000 }}}]}}}}'

Error:  
{"error": {"root\_cause": [{"type": "invalid\_type\_name\_exception","reason": "Document mapping type name can't start with '_'"}],"type": "invalid\_type\_name\_exception","reason": "Document mapping type name can't start with '_'"},"status": 400}

Could anybody please help with an easier way to purge such records with negative TTL?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 15, 2016, 1:00am UTC](https://discuss.elastic.co/t/negative-ttl-records-purging/66037/2 "2016-11-15T01:00:23Z")

</div>

What version are you on.

---

<div class="post-metadata">

**Author:** ![phoenix.s58](https://avatars.discourse-cdn.com/v4/letter/p/3e96dc/32.png) [@phoenix.s58](https://discuss.elastic.co/u/phoenix.s58)\
**Post date:** [November 15, 2016, 1:35am UTC](https://discuss.elastic.co/t/negative-ttl-records-purging/66037/3 "2016-11-15T01:35:13Z")

</div>

"version" : {  
"number" : "2.3.2",  
"lucene\_version" : "5.5.0"  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 13, 2016, 1:35am UTC](https://discuss.elastic.co/t/negative-ttl-records-purging/66037/4 "2016-12-13T01:35:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.