# Search, then remove data for the results
**URL:** https://discuss.elastic.co/t/search-then-remove-data-for-the-results/23584
**Category:** Elasticsearch
**Created:** [May 7, 2015, 9:15pm UTC](https://discuss.elastic.co/t/search-then-remove-data-for-the-results/23584 "2015-05-07T21:15:47Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)
#### Post date: [May 7, 2015, 9:15pm UTC](https://discuss.elastic.co/t/search-then-remove-data-for-the-results/23584/1 "2015-05-07T21:15:47Z")
I am looking for assistance.
I have an elasticsearch cluster that has an index called 'foo'. Within
foo, I have a ton of information that contains the string "Error in the RPC
receive". I need to do a search for any message that contains that string,
then delete anything.
I have seen several examples, but am not able to flush what I need. I am
using the Chrome extension Postman.
I have tried simple queries such as:
{
"match\_phrase" : {
"message" : "Error in the RPC receive"
}
}
but to no avail.
Can I please request some help?
## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/716fda8d-5cd8-410a-9554-05469a45c7ac%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/716fda8d-5cd8-410a-9554-05469a45c7ac%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Allan\_Mitchell](https://discuss.elastic.co/u/Allan_Mitchell)
#### Post date: [May 8, 2015, 8:58am UTC](https://discuss.elastic.co/t/search-then-remove-data-for-the-results/23584/2 "2015-05-08T08:58:14Z")
Do you want something like this
> **[Delete documents | Elasticsearch API documentation](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-delete-by-query)**
>
> Deletes documents that match the specified query.
> If the Elasticsearch security features are enabled, you must have the following index privileges for the target data stream, in...
Allan
On 7 May 2015 at 22:15, [dpich@realtruck.com](mailto:dpich@realtruck.com) wrote:
> I am looking for assistance.
>
> I have an elasticsearch cluster that has an index called 'foo'. Within
> foo, I have a ton of information that contains the string "Error in the RPC
> receive". I need to do a search for any message that contains that string,
> then delete anything.
>
> I have seen several examples, but am not able to flush what I need. I am
> using the Chrome extension Postman.
>
> I have tried simple queries such as:
>
> {
> "match\_phrase" : {
> "message" : "Error in the RPC receive"
> }
> }
>
> but to no avail.
>
> Can I please request some help?
>
> ## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
>
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/716fda8d-5cd8-410a-9554-05469a45c7ac%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/716fda8d-5cd8-410a-9554-05469a45c7ac%40googlegroups.com)
> [https://groups.google.com/d/msgid/elasticsearch/716fda8d-5cd8-410a-9554-05469a45c7ac%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/716fda8d-5cd8-410a-9554-05469a45c7ac%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAECdJzBiZgwZZX%3DfO%2BCiseGuXMfQj2xFjZno6P7S-q0mcF\_\_Zg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAECdJzBiZgwZZX%3DfO%2BCiseGuXMfQj2xFjZno6P7S-q0mcF__Zg%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)
#### Post date: [May 8, 2015, 2:15pm UTC](https://discuss.elastic.co/t/search-then-remove-data-for-the-results/23584/3 "2015-05-08T14:15:30Z")
I haven't gotten any real results to share with what I've done. I'm still
learning API calls. But what I was using as a search parameter was this:
curl -XPOST '[http://192.168.1.72:9200/\_search?1=tag:message](http://192.168.1.72:9200/_search?1=tag:message)'
Here is an example of the raw json message:
> {"message":"[warning] [vmusr:vmusr] Error in the RPC receive loop:
> RpcIn: Unable to
> send.\n","@version":"1","@timestamp":"2015-05-06T05:22:45.000Z","host":"192.168.1.38:64173","type":"windowsEventLog","logType":"windowsEventLog","EventTime":"2015-05-06
> 00:22:45","Hostname":"server.local","Keywords":36028797018963970,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":1000,"SourceName":"VMware
> Tools","Task":0,"RecordNumber":10516558,"ProcessID":0,"ThreadID":0,"Channel":"Application","Domain":"REALTRUCK","AccountName":"User","UserID":"User","AccountType":"User","Opcode":"Info","EventReceivedTime":1430889766,"SourceModuleName":"eventlog","SourceModuleType":"im\_msvistalog","receivedAt":"2015-05-06
> 05:22:46 UTC"}
My intended goal is to search the message for the string "Error in the RPC
receive loop", and if the entry contains this text string, delete the
entry.
## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Allan\_Mitchell](https://discuss.elastic.co/u/Allan_Mitchell)
#### Post date: [May 8, 2015, 2:38pm UTC](https://discuss.elastic.co/t/search-then-remove-data-for-the-results/23584/4 "2015-05-08T14:38:16Z")
Hi
Then it definitely sounds like delete\_by\_query is your friend here. Follow
the link I sent earlier. If it not what you want then come back and tell
us why.
Allan
On 8 May 2015 at 15:15, [dpich@realtruck.com](mailto:dpich@realtruck.com) wrote:
> I haven't gotten any real results to share with what I've done. I'm still
> learning API calls. But what I was using as a search parameter was this:
> curl -XPOST '[http://192.168.1.72:9200/\_search?1=tag:message](http://192.168.1.72:9200/_search?1=tag:message)'
>
> Here is an example of the raw json message:
>
> > {"message":"[warning] [vmusr:vmusr] Error in the RPC receive loop:
> > RpcIn: Unable to
> > send.\n","@version":"1","@timestamp":"2015-05-06T05:22:45.000Z","host":"
> > 192.168.1.38:64173","type":"windowsEventLog","logType":"windowsEventLog","EventTime":"2015-05-06
> > 00:22:45","Hostname":"server.local","Keywords":36028797018963970,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":1000,"SourceName":"VMware
> > Tools","Task":0,"RecordNumber":10516558,"ProcessID":0,"ThreadID":0,"Channel":"Application","Domain":"REALTRUCK","AccountName":"User","UserID":"User","AccountType":"User","Opcode":"Info","EventReceivedTime":1430889766,"SourceModuleName":"eventlog","SourceModuleType":"im\_msvistalog","receivedAt":"2015-05-06
> > 05:22:46 UTC"}
>
> My intended goal is to search the message for the string "Error in the RPC
> receive loop", and if the entry contains this text string, delete the
> entry.
>
> ## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
>
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com)
> [https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAECdJzAWWZXJ1hrrFm9%3DFdd1SMKg\_Ft2gf%2BawWBx%2BqJxEKQKBQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAECdJzAWWZXJ1hrrFm9%3DFdd1SMKg_Ft2gf%2BawWBx%2BqJxEKQKBQ%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)
#### Post date: [May 8, 2015, 3:01pm UTC](https://discuss.elastic.co/t/search-then-remove-data-for-the-results/23584/5 "2015-05-08T15:01:04Z")
Hi Alan,
Thanks for your help.
Here is the query that finally got me some results:
curl XGET
'httpd://192.168.1.72:9200/logstash-2015.05.01/\_search?q=message:'Error in
the RPC receive''
This gives me the information I wanted to confirm before I deleted.
{
"took": 1990,
"timed\_out": false,
"\_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 123503,
"max\_score": 2.8327804,
"hits": [
{
...foo...
When I switch this to this command (curl XDELETE
'httpd://192.168.1.72:9200/logstash-2015.05.01/\_search?q=message:'Error in
the RPC receive''), The other node in the cluster has an issue:
{
```
"error": "RemoteTransportException[[es-logstash-n2][inet[/192.168.1.80:9301]][indices:admin/mapping/delete]]; nested: TypeMissingException[[_all] type[[_search]] missing: No index has the type.]; ",
"status": 404
```
}
On Friday, May 8, 2015 at 9:38:31 AM UTC-5, Allan Mitchell wrote:
> Hi
>
> Then it definitely sounds like delete\_by\_query is your friend here.
> Follow the link I sent earlier. If it not what you want then come back and
> tell us why.
>
> Allan
>
> On 8 May 2015 at 15:15, \<[dp...@realtruck.com](mailto:dp...@realtruck.com) \\> wrote:
>
> > I haven't gotten any real results to share with what I've done. I'm
> > still learning API calls. But what I was using as a search parameter was
> > this: curl -XPOST '[http://192.168.1.72:9200/\_search?1=tag:message](http://192.168.1.72:9200/_search?1=tag:message)'
> >
> > Here is an example of the raw json message:
> >
> > > {"message":"[warning] [vmusr:vmusr] Error in the RPC receive loop:
> > > RpcIn: Unable to
> > > send.\n","@version":"1","@timestamp":"2015-05-06T05:22:45.000Z","host":"
> > > 192.168.1.38:64173","type":"windowsEventLog","logType":"windowsEventLog","EventTime":"2015-05-06
> > > 00:22:45","Hostname":"server.local","Keywords":36028797018963970,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":1000,"SourceName":"VMware
> > > Tools","Task":0,"RecordNumber":10516558,"ProcessID":0,"ThreadID":0,"Channel":"Application","Domain":"REALTRUCK","AccountName":"User","UserID":"User","AccountType":"User","Opcode":"Info","EventReceivedTime":1430889766,"SourceModuleName":"eventlog","SourceModuleType":"im\_msvistalog","receivedAt":"2015-05-06
> > > 05:22:46 UTC"}
> >
> > My intended goal is to search the message for the string "Error in the
> > RPC receive loop", and if the entry contains this text string, delete the
> > entry.
> >
> > ## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
> >
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \.
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com)
> > [https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com?utm_medium=email&utm_source=footer)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Allan\_Mitchell](https://discuss.elastic.co/u/Allan_Mitchell)
#### Post date: [May 8, 2015, 3:12pm UTC](https://discuss.elastic.co/t/search-then-remove-data-for-the-results/23584/6 "2015-05-08T15:12:26Z")
Hi
Wouldn't you want the \_query endpoint not the \_search endpoint.
from the documentation
curl -XDELETE '[http://localhost:9200/twitter/tweet/\_query?q=user:kimchy](http://localhost:9200/twitter/tweet/_query?q=user:kimchy)'
On 8 May 2015 at 16:01, [dpich@realtruck.com](mailto:dpich@realtruck.com) wrote:
> Hi Alan,
>
> Thanks for your help.
>
> Here is the query that finally got me some results:
>
> curl XGET 'httpd://
> 192.168.1.72:9200/logstash-2015.05.01/\_search?q=message:'Error in the RPC
> receive''
>
> This gives me the information I wanted to confirm before I deleted.
>
> {
> "took": 1990,
> "timed\_out": false,
> "\_shards": {
> "total": 5,
> "successful": 5,
> "failed": 0
> },
> "hits": {
> "total": 123503,
> "max\_score": 2.8327804,
> "hits": [
> {
> ...foo...
>
> When I switch this to this command (curl XDELETE 'httpd://
> 192.168.1.72:9200/logstash-2015.05.01/\_search?q=message:'Error in the RPC
> receive''), The other node in the cluster has an issue:
>
> {
>
> ```
> "error": "RemoteTransportException[[es-logstash-n2][inet[/192.168.1.80:9301]][indices:admin/mapping/delete]]; nested: TypeMissingException[[_all] type[[_search]] missing: No index has the type.]; ",
>
> "status": 404
>
> ```
>
> }
>
> On Friday, May 8, 2015 at 9:38:31 AM UTC-5, Allan Mitchell wrote:
>
> > Hi
> >
> > Then it definitely sounds like delete\_by\_query is your friend here.
> > Follow the link I sent earlier. If it not what you want then come back and
> > tell us why.
> >
> > Allan
> >
> > On 8 May 2015 at 15:15, [dp...@realtruck.com](mailto:dp...@realtruck.com) wrote:
> >
> > > I haven't gotten any real results to share with what I've done. I'm
> > > still learning API calls. But what I was using as a search parameter was
> > > this: curl -XPOST '[http://192.168.1.72:9200/\_search?1=tag:message](http://192.168.1.72:9200/_search?1=tag:message)'
> > >
> > > Here is an example of the raw json message:
> > >
> > > > {"message":"[warning] [vmusr:vmusr] Error in the RPC receive loop:
> > > > RpcIn: Unable to
> > > > send.\n","@version":"1","@timestamp":"2015-05-06T05:22:45.000Z","host":"
> > > > 192.168.1.38:64173","type":"windowsEventLog","logType":"windowsEventLog","EventTime":"2015-05-06
> > > > 00:22:45","Hostname":"server.local","Keywords":36028797018963970,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":1000,"SourceName":"VMware
> > > > Tools","Task":0,"RecordNumber":10516558,"ProcessID":0,"ThreadID":0,"Channel":"Application","Domain":"REALTRUCK","AccountName":"User","UserID":"User","AccountType":"User","Opcode":"Info","EventReceivedTime":1430889766,"SourceModuleName":"eventlog","SourceModuleType":"im\_msvistalog","receivedAt":"2015-05-06
> > > > 05:22:46 UTC"}
> > >
> > > My intended goal is to search the message for the string "Error in the
> > > RPC receive loop", and if the entry contains this text string, delete the
> > > entry.
> > >
> > > ## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
> > >
> > > You received this message because you are subscribed to the Google
> > > Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send
> > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com).
> > > To view this discussion on the web visit
> > > [https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com)
> > > [https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > .
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
>
> * * *
>
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com)
> [https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
>
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAECdJzDP%3DNiP%2BOoiL\_1xEfvs4fXRE%3DpG11YwZB%2BxuoB5mWWHCQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAECdJzDP%3DNiP%2BOoiL_1xEfvs4fXRE%3DpG11YwZB%2BxuoB5mWWHCQ%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)
#### Post date: [May 8, 2015, 3:44pm UTC](https://discuss.elastic.co/t/search-then-remove-data-for-the-results/23584/7 "2015-05-08T15:44:53Z")
Thanks Alan,
That did the trick! I appreciate the assistance.
On Friday, May 8, 2015 at 10:12:35 AM UTC-5, Allan Mitchell wrote:
> Hi
>
> Wouldn't you want the \_query endpoint not the \_search endpoint.
>
> from the documentation
>
> curl -XDELETE '[http://localhost:9200/twitter/tweet/\_query?q=user:kimchy](http://localhost:9200/twitter/tweet/_query?q=user:kimchy)'
>
> On 8 May 2015 at 16:01, \<[dp...@realtruck.com](mailto:dp...@realtruck.com) \\> wrote:
>
> > Hi Alan,
> >
> > Thanks for your help.
> >
> > Here is the query that finally got me some results:
> >
> > curl XGET 'httpd://
> > 192.168.1.72:9200/logstash-2015.05.01/\_search?q=message:'Error in the
> > RPC receive''
> >
> > This gives me the information I wanted to confirm before I deleted.
> >
> > {
> > "took": 1990,
> > "timed\_out": false,
> > "\_shards": {
> > "total": 5,
> > "successful": 5,
> > "failed": 0
> > },
> > "hits": {
> > "total": 123503,
> > "max\_score": 2.8327804,
> > "hits": [
> > {
> > ...foo...
> >
> > When I switch this to this command (curl XDELETE 'httpd://
> > 192.168.1.72:9200/logstash-2015.05.01/\_search?q=message:'Error in the
> > RPC receive''), The other node in the cluster has an issue:
> >
> > {
> >
> > ```
> > "error": "RemoteTransportException[[es-logstash-n2][inet[/192.168.1.80:9301]][indices:admin/mapping/delete]]; nested: TypeMissingException[[_all] type[[_search]] missing: No index has the type.]; ",
> >
> > "status": 404
> >
> > ```
> >
> > }
> >
> > On Friday, May 8, 2015 at 9:38:31 AM UTC-5, Allan Mitchell wrote:
> >
> > > Hi
> > >
> > > Then it definitely sounds like delete\_by\_query is your friend here.
> > > Follow the link I sent earlier. If it not what you want then come back and
> > > tell us why.
> > >
> > > Allan
> > >
> > > On 8 May 2015 at 15:15, [dp...@realtruck.com](mailto:dp...@realtruck.com) wrote:
> > >
> > > > I haven't gotten any real results to share with what I've done. I'm
> > > > still learning API calls. But what I was using as a search parameter was
> > > > this: curl -XPOST '[http://192.168.1.72:9200/\_search?1=tag:message](http://192.168.1.72:9200/_search?1=tag:message)'
> > > >
> > > > Here is an example of the raw json message:
> > > >
> > > > > {"message":"[warning] [vmusr:vmusr] Error in the RPC receive loop:
> > > > > RpcIn: Unable to
> > > > > send.\n","@version":"1","@timestamp":"2015-05-06T05:22:45.000Z","host":"
> > > > > 192.168.1.38:64173","type":"windowsEventLog","logType":"windowsEventLog","EventTime":"2015-05-06
> > > > > 00:22:45","Hostname":"server.local","Keywords":36028797018963970,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":1000,"SourceName":"VMware
> > > > > Tools","Task":0,"RecordNumber":10516558,"ProcessID":0,"ThreadID":0,"Channel":"Application","Domain":"REALTRUCK","AccountName":"User","UserID":"User","AccountType":"User","Opcode":"Info","EventReceivedTime":1430889766,"SourceModuleName":"eventlog","SourceModuleType":"im\_msvistalog","receivedAt":"2015-05-06
> > > > > 05:22:46 UTC"}
> > > >
> > > > My intended goal is to search the message for the string "Error in the
> > > > RPC receive loop", and if the entry contains this text string, delete the
> > > > entry.
> > > >
> > > > ## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
> > > >
> > > > You received this message because you are subscribed to the Google
> > > > Groups "elasticsearch" group.
> > > > To unsubscribe from this group and stop receiving emails from it, send
> > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com).
> > > > To view this discussion on the web visit
> > > > [https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com)
> > > > [https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > > .
> > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> > >
> > > --
> > > Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
> >
> > * * *
> >
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \.
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com)
> > [https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com?utm_medium=email&utm_source=footer)
> > .
> >
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
## -- Please update your bookmarks! We moved to [https://discuss.elastic.co/](https://discuss.elastic.co/)
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/d3e4229e-952e-4a08-bf34-08793b1dcdbd%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/d3e4229e-952e-4a08-bf34-08793b1dcdbd%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:15am UTC](https://discuss.elastic.co/t/search-then-remove-data-for-the-results/23584/8 "2017-07-06T00:15:01Z")