# XDELETE remove no records **URL:** \ **Category:** Elasticsearch\ **Created:** [March 29, 2016, 11:09am UTC](https://discuss.elastic.co/t/xdelete-remove-no-records/45677 "2016-03-29T11:09:00Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![rodi](https://avatars.discourse-cdn.com/v4/letter/r/ec9cab/32.png) [@rodi](https://discuss.elastic.co/u/rodi)\ **Post date:** [March 29, 2016, 11:09am UTC](https://discuss.elastic.co/t/xdelete-remove-no-records/45677/1 "2016-03-29T11:09:00Z")
Hello We use Elasticsearch Version is 1.7.1 and i have this script and want delete old messages on Graylog. #!/bin/sh FDATE=`date +"%F %H:%M:%S.000" --date="60 days ago"` TDATE=`date +"%F %H:%M:%S.000" --date="0 days ago"` RANGE='{ "query": { "filtered": { "query": { "query\_string": { "query": "level:7", "allow\_leading\_wildcard": false } }, "filter": { "bool": { "must": { "range": { "timestamp": { "from": "'${FDATE}'", "to": "'${TDATE}'", "include\_lower": true, "include\_upper": true } } } } } } } }' /usr/bin/curl -v3 -H "Content-Type: application/json" -XDELETE "[http://127.0.0.1:9200/graylog2\_\*/message/\_query](http://127.0.0.1:9200/graylog2_*/message/_query)" -d "${RANGE}" When i run this script, then i have this output - About to connect() to 127.0.0.1 port 9200 (#0) - Trying 127.0.0.1... connected - Connected to 127.0.0.1 (127.0.0.1) port 9200 (#0) > DELETE /graylog2\_\*/message/\_query HTTP/1.1 > User-Agent: curl/7.19.7 (x86\_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2 > Host: 127.0.0.1:9200 > Accept: _/_ > Content-Type: application/json > Content-Length: 523 \< HTTP/1.1 200 OK \< Content-Type: application/json; charset=UTF-8 \< Content-Length: 203 \< - Connection #0 to host 127.0.0.1 left intact - Closing connection #0 {"\_indices":{"graylog2\_3":{"\_shards":{"total":4,"successful":4,"failed":0}},"graylog2\_2":{"\_shards":{"total":4,"successful":4,"failed":0}},"graylog2\_4":{"\_shards":{"total":4,"successful":4,"failed":0}}}} [blcrood@blx-lm00 scripts]$ No records will be deleted and i have no error. What is the reason because no records will be deleted? regards Steve ---
**Author:** ![kirill\_polishchuk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kirill_polishchuk/32/6489_2.png) [@kirill\_polishchuk](https://discuss.elastic.co/u/kirill_polishchuk)\ **Post date:** [March 29, 2016, 5:01pm UTC](https://discuss.elastic.co/t/xdelete-remove-no-records/45677/2 "2016-03-29T17:01:48Z")
Try to use `@timestamp` field instead of `timestamp` . Also for @timestamp you should use date format with 'T' : for example: date +"%FT%H:%M:%S.000" --date="60 days ago" ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 29, 2016, 8:44pm UTC](https://discuss.elastic.co/t/xdelete-remove-no-records/45677/3 "2016-03-29T20:44:55Z")
Doesn't graylog use time based indices? ---
**Author:** ![rodi](https://avatars.discourse-cdn.com/v4/letter/r/ec9cab/32.png) [@rodi](https://discuss.elastic.co/u/rodi)\ **Post date:** [March 30, 2016, 5:57am UTC](https://discuss.elastic.co/t/xdelete-remove-no-records/45677/4 "2016-03-30T05:57:40Z")
Thank you, i can my script to FDATE=date +"%FT%H:%M:%S.000" --date="60 days ago" TDATE=date +"%FT%H:%M:%S.000" --date="0 days ago" and when i then run the script, then i have this error. {"\_indices":{"graylog2\_3":{"\_shards":{"total":4,"successful":0,"failed":4,"failures":[{"index":"graylog2\_3","shard":0,"reason":"QueryParsingException[[graylog2\_3] Failed to parse]; nested: ElasticsearchParseException[failed to parse date field [], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number]; nested: IllegalArgumentException[Invalid format: ""]; "},{"index":"graylog2\_3","shard":1,"reason":"QueryParsingException[[graylog2\_3] Failed to parse]; nested: ElasticsearchParseException[failed to parse date field [], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number]; nested: IllegalArgumentException[Invalid format: ""]; "},{"index":"graylog2\_3","shard":2,"reason":"QueryParsingException[[graylog2\_3] Failed to parse]; nested: ElasticsearchParseException[failed to parse date field [], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number]; nested: IllegalArgumentException[Invalid format: ""]; "},{"index":"graylog2\_3","shard":3,"reason":"QueryParsingException[[graylog2\_3] Failed to parse]; nested: ElasticsearchParseException[failed to parse date field [], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number]; nested: IllegalArgumentException[Invalid format: ""]; "}]}},"graylog2\_2":{"\_shards":{"total":4,"successful":0,"failed":4,"failures":[{"index":"graylog2\_2","shard":0,"reason":"QueryParsingException[[graylog2\_2] Failed to parse]; nested: ElasticsearchParseException[failed to parse date field [], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number]; nested: IllegalArgumentException[Invalid format: ""]; "},{"index":"graylog2\_2","shard":1,"reason":"QueryParsingException[[graylog2\_2] Failed to parse]; nested: ElasticsearchParseException[failed to parse date field [], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number]; nested: IllegalArgumentException[Invalid format: ""]; "},{"index":"graylog2\_2","shard":2,"reason":"QueryParsingException[[graylog2\_2] Failed to parse]; nested: ElasticsearchParseException[failed to parse date field [], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number]; nested: IllegalArgumentException[Invalid format: ""]; "},{"index":"graylog2\_2","shard":3,"reason":"QueryParsingException[[graylog2\_2] Failed to parse]; nested: ElasticsearchParseException[failed to parse date field [], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number]; nested: IllegalArgumentException[Invalid format: ""]; "}]}},"graylog2\_4":{"\_shards":{"total":4,"successful":0,"failed":4,"failures":[{"index":"graylog2\_4","shard":0,"reason":"QueryParsingException[[graylog2\_4] Failed to parse]; nested: ElasticsearchParseException[failed to parse date field [], tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number]; nested: IllegalArgumentException[Invalid format: ""]; "},{"index":"graylog2\_4","shard":1,"reason":"QueryParsingException[[graylog2\_4] Failed to parse]; nested: ElasticsearchParseException[failed to parse date field [], tried both date format [yy\* Connection #0 to host 127.0.0.1 left intact Is my date format wrong? regards Steve ---
**Author:** ![cbuescher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cbuescher/32/60402_2.png) [@cbuescher](https://discuss.elastic.co/u/cbuescher)\ **Post date:** [March 30, 2016, 8:54am UTC](https://discuss.elastic.co/t/xdelete-remove-no-records/45677/5 "2016-03-30T08:54:51Z")
Hi, > [@rodi](#): > > failed to parse date field , tried both date format [yyyy-MM-dd HH:mm:ss.SSS], and timestamp number This error means that the date format you are using in from/to in your [Range query](https://www.elastic.co/guide/en/elasticsearch/reference/1.7/query-dsl-range-query.html) cannot be parsed by the one that is defined in your date field mapping (which looks like the default one). You should try to use the `format` parameter to match the date format that your script is inserting into the query. The format parameter supports another date format than the one defined in mapping. Also, since the field name is not shown correctly in the error message (`field []`) you should check again how the field is called in your index. As @kirill_polishchuk mentioned, it could be `@timestamp`. ---
**Author:** ![rodi](https://avatars.discourse-cdn.com/v4/letter/r/ec9cab/32.png) [@rodi](https://discuss.elastic.co/u/rodi)\ **Post date:** [March 30, 2016, 9:22am UTC](https://discuss.elastic.co/t/xdelete-remove-no-records/45677/6 "2016-03-30T09:22:34Z")
Thank you very much, but sorry i'm not so the format guru for a bash script. The original graylog query is like that. "range": { "timestamp": { "from": "2016-02-29 05:48:29.700", "to": "2016-03-30 05:48:29.700", "include\_lower": true, "include\_upper": true } } What is the right format form my variables (FDATE and TDATE)? regards Steve ---
**Author:** ![rodi](https://avatars.discourse-cdn.com/v4/letter/r/ec9cab/32.png) [@rodi](https://discuss.elastic.co/u/rodi)\ **Post date:** [March 30, 2016, 9:33am UTC](https://discuss.elastic.co/t/xdelete-remove-no-records/45677/7 "2016-03-30T09:33:12Z")
With me original code $ date +"%F %H:%M:%S.000" 2016-03-30 11:24:57.000 i have same syntax like the original graylog query. I have no errors but no messages will be deleted. I don't understand when i use the same query with XGET (not XDELETE), then i have a output with "hits" : { "total" : 1300060, it find messages to delete but when i use the same query with XDELETE not works. regards Steve ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:04pm UTC](https://discuss.elastic.co/t/xdelete-remove-no-records/45677/8 "2017-07-05T23:04:07Z")