# Wipe logs according to timestamp

**URL:** <https://discuss.elastic.co/t/wipe-logs-according-to-timestamp/97536>\
**Category:** Elasticsearch\
**Created:** [August 18, 2017, 8:39am UTC](https://discuss.elastic.co/t/wipe-logs-according-to-timestamp/97536 "2017-08-18T08:39:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hun](https://avatars.discourse-cdn.com/v4/letter/h/cab0a1/32.png) [@hun](https://discuss.elastic.co/u/hun)\
**Post date:** [August 18, 2017, 8:39am UTC](https://discuss.elastic.co/t/wipe-logs-according-to-timestamp/97536/1 "2017-08-18T08:39:25Z")

</div>

Hi All,

I have 2 elasticsearch nodes version 2.4.3 and I am trying to delete some logs that fall in a certain time range. When I search for the logs in the time range I specify, I get the following:

```
{
  "took" : 174,
  "timed_out" : false,
  "_shards" : {
    "total" : 4,
    "successful" : 4,
    "failed" : 0
  },
  "hits" : {
    "total" : 2498365,
    "max_score" : 1.0,

```

To get that I execute the following:

```
curl -XGET "http://elasticsearch_IP:9200/graylog_index/message/_search?pretty=true" -d '
{
   "query": {
        "range" : {
         "timestamp" : { "gt" : "2017-07-27 00:00:00.000", "lt" : "2017-07-29 00:00:00.000"}
     }
   }
}'

```

When deleting I am substituting "-XGET" with "-XDELETE" and "\_search" with "\_delete\_by\_query" and this returning not found:

```
{
  "found" : false,
  "_index" : "graylog_index",
  "_type" : "message",
  "_id" : "_delete_by_query",
  "_version" : 1,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "failed" : 0
  }
}

```

Knowing that I already installed the delete-by-query plugin and checked that it is there! Thanks in advance.

---

<div class="post-metadata">

**Author:** ![danielmitterdorfer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmitterdorfer/32/110510_2.png) [@danielmitterdorfer](https://discuss.elastic.co/u/danielmitterdorfer)\
**Post date:** [August 22, 2017, 1:08pm UTC](https://discuss.elastic.co/t/wipe-logs-according-to-timestamp/97536/2 "2017-08-22T13:08:03Z")

</div>

Hi @hun,

it's a bit trappy but [according to the docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html) you need to use `-XPOST` not `-XDELETE`. As we can see from the output at the bottom of your post, Elasticsearch tried to delete a document with the id `_delete_by_query`with the request that you've sent.

Daniel

---

<div class="post-metadata">

**Author:** ![hun](https://avatars.discourse-cdn.com/v4/letter/h/cab0a1/32.png) [@hun](https://discuss.elastic.co/u/hun)\
**Post date:** [August 22, 2017, 1:23pm UTC](https://discuss.elastic.co/t/wipe-logs-according-to-timestamp/97536/3 "2017-08-22T13:23:25Z")

</div>

Hey Daniel,

Thanks for emphasising that, I already realised my mistake.

Cheers

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2017, 1:23pm UTC](https://discuss.elastic.co/t/wipe-logs-according-to-timestamp/97536/4 "2017-09-19T13:23:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.