Using the Curl Command

Elastic Stack Logstash
2
  1. Yes, set the the size parameter in the query body. See https://www.elastic.co/guide/en/elasticsearch/reference/1.7/search-request-from-size.html.
  2. Yes, documents are only available for queries after a refresh has taken place. Logstash indexes will (IIRC) be refreshed every five seconds by default.
  3. Use the delete API to delete documents by id and the delete by query API to, well, delete documents based on a query (but note that it's deprecated).
  4. That's impossible to answer with the information you've given us.