Trying to delete documents in index older than XXX

Elastic Stack Elasticsearch
1

I need to delete some documents from indexes older than XXX days, but delete_by_query doesn't seem to be working for me.

Here is an example query I'm trying to run

POST shipment-log/_delete_by_query
{
  "query": {
    "range": {
      "@timestamp": {
        "lte": "2023"
      }
    }
  }
}

and here is the response I get

{
  "error" : {
    "root_cause" : [
      {
        "type" : "action_request_validation_exception",
        "reason" : "Validation Failed: 1: query is missing;"
      }
    ],
    "type" : "action_request_validation_exception",
    "reason" : "Validation Failed: 1: query is missing;"
  },
  "status" : 400
}

conversely I can run this same command on a different index

POST hrapp-log/_delete_by_query
{
  "query": {
    "range": {
      "@timestamp": {
        "lte": "2023"
      }
    }
  }
}

and I do not get an error response but rather it just doesn't work

{
  "took" : 50,
  "timed_out" : false,
  "total" : 0,
  "deleted" : 0,
  "batches" : 0,
  "version_conflicts" : 0,
  "noops" : 0,
  "retries" : {
    "bulk" : 0,
    "search" : 0
  },
  "throttled_millis" : 0,
  "requests_per_second" : -1.0,
  "throttled_until_millis" : 0,
  "failures" : [ ]
}

it may be the @lte condition but I do not understand why I'm getting an error for one index but not for another

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.