Unable to delete by query

Elastic Stack Elasticsearch
1

I do some post processing on some logs for another system that we use and I am trying to get rid of docs that have invalid/missing data in them. This is not the best way to solve this, but for now it's what I have to do. I have a list of all of the doc ids that need to be deleted, but I cannot get them to delete with an error about final mappings. Did a search on the final mapping error and while I understand it, I really don't care about it and just want the docs gone.

I have a file called notfound.txt that contains all of the ids and I was trying to loop through it and send delete_by_query but I get the following error:

{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Rejecting mapping update to [threat-2018.12] as the final mapping would have more than 1 type: [delete_by_query, doc]"}],"type":"illegal_argument_exception","reason":"Rejecting mapping update to [threat-2018.12] as the final mapping would have more than 1 type: [delete_by_query, doc]"},"status":400}

Here is the cmd line I am running to do the delete:

 for line in `sort -u notfound.txt`;do curl -XPOST -H'Content-Type: application/json' 'http://elasticsearch:9200/threat-2018.12/delete_by_query' -d '{
  "query": {
    "match": {
      "_id": "$line"
    }
  }
}'; done

Any help is greatly appreciated.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.