Search, then remove data for the results

Elastic Stack Elasticsearch
6

Hi

Wouldn't you want the _query endpoint not the _search endpoint.

from the documentation

curl -XDELETE 'http://localhost:9200/twitter/tweet/_query?q=user:kimchy'

On 8 May 2015 at 16:01, dpich@realtruck.com wrote:

Hi Alan,

Thanks for your help.

Here is the query that finally got me some results:

curl XGET 'httpd://
192.168.1.72:9200/logstash-2015.05.01/_search?q=message:'Error in the RPC
receive''

This gives me the information I wanted to confirm before I deleted.

{
"took": 1990,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 123503,
"max_score": 2.8327804,
"hits": [
{
...foo...

When I switch this to this command (curl XDELETE 'httpd://
192.168.1.72:9200/logstash-2015.05.01/_search?q=message:'Error in the RPC
receive''), The other node in the cluster has an issue:

{

"error": "RemoteTransportException[[es-logstash-n2][inet[/192.168.1.80:9301]][indices:admin/mapping/delete]]; nested: TypeMissingException[[_all] type[[_search]] missing: No index has the type.]; ",

"status": 404

}

On Friday, May 8, 2015 at 9:38:31 AM UTC-5, Allan Mitchell wrote:

Hi

Then it definitely sounds like delete_by_query is your friend here.
Follow the link I sent earlier. If it not what you want then come back and
tell us why.

Allan

On 8 May 2015 at 15:15, dp...@realtruck.com wrote:

I haven't gotten any real results to share with what I've done. I'm
still learning API calls. But what I was using as a search parameter was
this: curl -XPOST 'http://192.168.1.72:9200/_search?1=tag:message'

Here is an example of the raw json message:

{"message":"[ warning] [vmusr:vmusr] Error in the RPC receive loop:
RpcIn: Unable to
send.\n","@version":"1","@timestamp":"2015-05-06T05:22:45.000Z","host":"
192.168.1.38:64173","type":"windowsEventLog","logType":"windowsEventLog","EventTime":"2015-05-06
00:22:45","Hostname":"server.local","Keywords":36028797018963970,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":1000,"SourceName":"VMware
Tools","Task":0,"RecordNumber":10516558,"ProcessID":0,"ThreadID":0,"Channel":"Application","Domain":"REALTRUCK","AccountName":"User","UserID":"User","AccountType":"User","Opcode":"Info","EventReceivedTime":1430889766,"SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog","receivedAt":"2015-05-06
05:22:46 UTC"}

My intended goal is to search the message for the string "Error in the
RPC receive loop", and if the entry contains this text string, delete the
entry.

--
Please update your bookmarks! We moved to https://discuss.elastic.co/

You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearc...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/422e1224-20fb-4dca-b891-e482e08e6de0%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
Please update your bookmarks! We moved to https://discuss.elastic.co/

You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/490f6957-9ac9-4570-bbf7-54377457a3ad%40googlegroups.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
Please update your bookmarks! We moved to https://discuss.elastic.co/

You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAECdJzDP%3DNiP%2BOoiL_1xEfvs4fXRE%3DpG11YwZB%2BxuoB5mWWHCQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.