# Unable to delete documents from index when using logstash output plugin

**URL:** https://discuss.elastic.co/t/unable-to-delete-documents-from-index-when-using-logstash-output-plugin/91303
**Category:** Logstash
**Created:** [June 29, 2017, 2:56pm UTC](https://discuss.elastic.co/t/unable-to-delete-documents-from-index-when-using-logstash-output-plugin/91303 "2017-06-29T14:56:08Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![truesecure](https://avatars.discourse-cdn.com/v4/letter/t/f07891/32.png) [@truesecure](https://discuss.elastic.co/u/truesecure)
#### Post date: [June 29, 2017, 2:56pm UTC](https://discuss.elastic.co/t/unable-to-delete-documents-from-index-when-using-logstash-output-plugin/91303/1 "2017-06-29T14:56:08Z")

</div>

My logstash plugin isn't deleting the docs in the index. It appears to be ignoring the document\_id it is being passed, and instead just uses the variable name (as opposed to the value).

I have the following configuration in my logstash config:

output {  
elasticsearch {  
hosts =\> "10.10.10.128:9200"  
index =\> "my\_index"  
document\_type =\> "my\_doc"  
document\_id =\> "%{my\_id}"  
action =\> "delete"  
}  
}

And I see this in the logs:

[2017-06-29T09:19:37,727][DEBUG][logstash.pipeline] output received {"message"=\>"{"my\_id":"1:4656476"}"}}

and then ...

[2017-06-29T09:19:37,734][DEBUG][org.apache.http.wire] http-outgoing-0 \>\> "{"delete":{"\_id":"%{my\_id}","\_index":"my\_index","\_type":"my\_doc","\_routing":null}}"

Notice this (from above):

"\_id":"%{my\_id}"

I would have expected it to have used the actual value and read something like:

"\_id":"1:4656476"

Because it doesn't use the actual value, it doesn't delete anything from the index.

What am I doing wrong?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 29, 2017, 6:16pm UTC](https://discuss.elastic.co/t/unable-to-delete-documents-from-index-when-using-logstash-output-plugin/91303/2 "2017-06-29T18:16:47Z")

</div>

> [2017-06-29T09:19:37,727][DEBUG][logstash.pipeline] output received {"message"=\>"{"my\_id":"1:4656476"}"}}

This suggests that your events don't have a `my_id` field but that the `message` field contains `{"my_id":"1:4656476"}`, indicating that you need a json filter or a `codec => json` or `codec => json_lines` setting in your input plugin in order to deserialize the JSON payload.

---

<div class="post-metadata">

### Author: ![truesecure](https://avatars.discourse-cdn.com/v4/letter/t/f07891/32.png) [@truesecure](https://discuss.elastic.co/u/truesecure)
#### Post date: [June 30, 2017, 2:33am UTC](https://discuss.elastic.co/t/unable-to-delete-documents-from-index-when-using-logstash-output-plugin/91303/3 "2017-06-30T02:33:40Z")

</div>

That was it! Thanks for your help.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 28, 2017, 2:34am UTC](https://discuss.elastic.co/t/unable-to-delete-documents-from-index-when-using-logstash-output-plugin/91303/4 "2017-07-28T02:34:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
