Arun,
This is a query that I've used for delete-by-query.
However, delete-by-query can be very expensive on your system [1] so be
careful with how you use this.
DELETE _query -d '{
"query":{
"bool":{
"must":[
{
"range":{
"logs.@timestamp":{
"from":"2014-01-01",
"to":"2014-03-01"
}
}
}
],
"must_not":[],
"should":[]
}
}
}'
[1]
https://www.found.no/foundation/keeping-elasticsearch-in-sync/#the-problems-of-too-frequent-updates-and-non-batch-updates
/petter
On Fri, Mar 28, 2014 at 11:08 AM, David Pilato <[email protected]> wrote:
> I don't think this is a correct query
>
> {
> "query" : {
> "term" : { "TransactionTime" : "from" : "2013-08-01", "to" :
> "2014-03-27"}
> }
> }
>
> Just try to parse it with: http://jsonformatter.curiousconcept.com/
>
>
> --
> *David Pilato* | *Technical Advocate* | *Elasticsearch.com*
> @dadoonet <https://twitter.com/dadoonet> |
> @elasticsearchfr<https://twitter.com/elasticsearchfr>
>
>
> Le 28 mars 2014 à 15:58:52, Arun Prasath ([email protected]) a
> écrit:
>
>
> this query works fine, it deletes all account number. the only issue is
> with date range. does it support date range.
>
> when i set TTL , all records should get deleted but not happening.
>
> DELETE /local-test/logs-test/_query
> {
> "query" : {
> "term" : { "AccountNumber" : "XXXXX"}
> }
> }
>
>
> On Friday, March 28, 2014 10:52:36 AM UTC-4, David Pilato wrote:
>>
>> This should fail. It's not a range query on date.
>> Look at: http://www.elasticsearch.org/guide/en/elasticsearch/
>> reference/current/query-dsl-range-filter.html#query-dsl-range-filter
>> or: http://www.elasticsearch.org/guide/en/elasticsearch/
>> reference/current/query-dsl-range-query.html
>>
>>
>> --
>> *David Pilato* | *Technical Advocate* | *Elasticsearch.com*
>> @dadoonet <https://twitter.com/dadoonet> |
>> @elasticsearchfr<https://twitter.com/elasticsearchfr>
>>
>>
>> Le 28 mars 2014 à 15:50:57, Arun Prasath ([email protected]) a écrit:
>>
>>
>> I did , now it doesn't delete mapping/index but still records are not
>> getting deleted for the given condition.
>>
>> I tried in both curl and Sense. Is the format correct. It it right way to
>> delete records for date range.
>>
>> DELETE /local-test/logs-test/_query
>> {
>> "query" : {
>> "term" : { "TransactionTime" : "from" : "2013-08-01", "to" :
>> "2014-03-27"}
>> }
>> }
>>
>> Apreciate your Help.
>>
>>
>>
>>
>> On Friday, March 28, 2014 10:27:39 AM UTC-4, David Pilato wrote:
>>>
>>> Ok. Thanks to Boaz for finding it.
>>> You did not run a DELETE by query: http://www.
>>> elasticsearch.org/guide/en/elasticsearch/reference/
>>> current/docs-delete-by-query.html#docs-delete-by-query
>>>
>>> But a DELETE MAPPING: http://www.elasticsearch.org/guide/en/
>>> elasticsearch/reference/current/indices-delete-
>>> mapping.html#indices-delete-mapping
>>>
>>> You need to add _query at the end.
>>>
>>> --
>>> *David Pilato* | *Technical Advocate* | *Elasticsearch.com*
>>> @dadoonet <https://twitter.com/dadoonet> |
>>> @elasticsearchfr<https://twitter.com/elasticsearchfr>
>>>
>>>
>>> Le 28 mars 2014 à 15:09:07, Arun Prasath ([email protected]) a écrit:
>>>
>>>
>>> Sorry.. Could you try with curl? - I don't know how to do this and
>>> where to execute curl. Could you please help me here.
>>>
>>> Should i execute curl in Fiddler or in Sense ?
>>>
>>> On Friday, March 28, 2014 10:03:34 AM UTC-4, David Pilato wrote:
>>>>
>>>> Hmmm... Wondering if SENSE support payload when using DELETE method...
>>>>
>>>> Could you try with curl?
>>>> Could you check also your date format. I think it's wrong.
>>>>
>>>> If none of those works, please create a full curl recreation.
>>>>
>>>> --
>>>> *David Pilato* | *Technical Advocate* | *Elasticsearch.com*
>>>> @dadoonet <https://twitter.com/dadoonet> |
>>>> @elasticsearchfr<https://twitter.com/elasticsearchfr>
>>>>
>>>>
>>>> Le 28 mars 2014 à 15:00:01, Arun Prasath ([email protected]) a
>>>> écrit:
>>>>
>>>>
>>>> David,
>>>>
>>>> I'm using following command in Sense. Is this correct ?
>>>>
>>>> Index - local-test
>>>> Type - logs-test
>>>>
>>>> DELETE /local-test/logs-test/
>>>> {
>>>> "query" : {
>>>> "range" : { "TransactionTime" : "from" : "2014-03-26 12:23:41",
>>>> "to" : "2014-03-26 12:24:40"}
>>>> }
>>>> }
>>>>
>>>> Thanks,
>>>> Arun
>>>>
>>>> On Friday, March 28, 2014 9:57:26 AM UTC-4, David Pilato wrote:
>>>>>
>>>>> Could you GIST a full curl recreation which reproduce your issue?
>>>>>
>>>>> See help if you don't know how to write it: http://www.elasticsearch.
>>>>> org/help
>>>>>
>>>>> --
>>>>> *David Pilato* | *Technical Advocate* | *Elasticsearch.com*
>>>>> @dadoonet <https://twitter.com/dadoonet> |
>>>>> @elasticsearchfr<https://twitter.com/elasticsearchfr>
>>>>>
>>>>>
>>>>> Le 28 mars 2014 à 14:55:09, Arun Prasath ([email protected]) a
>>>>> écrit:
>>>>>
>>>>> I tried in both the case it deletes complete index when criteria
>>>>> doesn't match. It should not delete if the condition doesn't match.
>>>>>
>>>>> Please let me know how to delete based on condition. Im trying this as
>>>>> TTL doesn't work. I don't know how to delete records from memory for
>>>>> particular date range.
>>>>>
>>>>> Appreicate your Help.
>>>>>
>>>>> On Thursday, March 27, 2014 5:55:05 PM UTC-4, David Pilato wrote:
>>>>>>
>>>>>> Use range not term
>>>>>>
>>>>>> --
>>>>>> David ;-)
>>>>>> Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs
>>>>>>
>>>>>> Le 27 mars 2014 à 22:34, Arun Prasath <[email protected]> a
>>>>>> écrit :
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> I would need to delete records from particular Type with date range.
>>>>>> I'm trying following command but it deletes all records from index.
>>>>>>
>>>>>> Is it right way to delete records.
>>>>>>
>>>>>> DELETE /index/type/
>>>>>> {
>>>>>> "query" : {
>>>>>> "term" : { "TransactionTime" : "from" : "2014-03-26
>>>>>> 12:23:41", "to" : "2014-03-26 12:24:40"}
>>>>>> }
>>>>>> }
>>>>>>
>>>>>> Thanks,
>>>>>> Arun
>>>>>>
>>>>>>
>>>>>> --
>>>>>> You received this message because you are subscribed to the Google
>>>>>> Groups "elasticsearch" group.
>>>>>> To unsubscribe from this group and stop receiving emails from it,
>>>>>> send an email to [email protected].
>>>>>> To view this discussion on the web visit https://groups.google.com/d/
>>>>>> msgid/elasticsearch/32ae7629-abd6-49fe-87a8-06dd075ed2a9%
>>>>>> 40googlegroups.com<https://groups.google.com/d/msgid/elasticsearch/32ae7629-abd6-49fe-87a8-06dd075ed2a9%40googlegroups.com?utm_medium=email&utm_source=footer>
>>>>>> .
>>>>>> For more options, visit https://groups.google.com/d/optout.
>>>>>>
>>>>>> --
>>>>> You received this message because you are subscribed to the Google
>>>>> Groups "elasticsearch" group.
>>>>> To unsubscribe from this group and stop receiving emails from it, send
>>>>> an email to [email protected].
>>>>> To view this discussion on the web visit https://groups.google.com/d/
>>>>> msgid/elasticsearch/8bcbddec-294d-4c0b-93be-b52b376fa0c3%
>>>>> 40googlegroups.com<https://groups.google.com/d/msgid/elasticsearch/8bcbddec-294d-4c0b-93be-b52b376fa0c3%40googlegroups.com?utm_medium=email&utm_source=footer>
>>>>> .
>>>>> For more options, visit https://groups.google.com/d/optout.
>>>>>
>>>>> --
>>>> You received this message because you are subscribed to the Google
>>>> Groups "elasticsearch" group.
>>>> To unsubscribe from this group and stop receiving emails from it, send
>>>> an email to [email protected].
>>>> To view this discussion on the web visit https://groups.google.com/d/
>>>> msgid/elasticsearch/e7caf4c7-5320-4568-ba8e-41efa6d4c24c%
>>>> 40googlegroups.com<https://groups.google.com/d/msgid/elasticsearch/e7caf4c7-5320-4568-ba8e-41efa6d4c24c%40googlegroups.com?utm_medium=email&utm_source=footer>
>>>> .
>>>> For more options, visit https://groups.google.com/d/optout.
>>>>
>>>> --
>>> You received this message because you are subscribed to the Google
>>> Groups "elasticsearch" group.
>>> To unsubscribe from this group and stop receiving emails from it, send
>>> an email to [email protected].
>>> To view this discussion on the web visit https://groups.google.com/d/
>>> msgid/elasticsearch/700353da-0f42-444f-84ad-3d1ff2615741%
>>> 40googlegroups.com<https://groups.google.com/d/msgid/elasticsearch/700353da-0f42-444f-84ad-3d1ff2615741%40googlegroups.com?utm_medium=email&utm_source=footer>
>>> .
>>> For more options, visit https://groups.google.com/d/optout.
>>>
>>> --
>> You received this message because you are subscribed to the Google Groups
>> "elasticsearch" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to [email protected].
>> To view this discussion on the web visit https://groups.google.com/d/
>> msgid/elasticsearch/3e7d9d0a-41b5-4270-a200-b45583022fde%
>> 40googlegroups.com<https://groups.google.com/d/msgid/elasticsearch/3e7d9d0a-41b5-4270-a200-b45583022fde%40googlegroups.com?utm_medium=email&utm_source=footer>
>> .
>> For more options, visit https://groups.google.com/d/optout.
>>
>> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/elasticsearch/11c3c3af-0814-43ea-b853-22182450a601%40googlegroups.com<https://groups.google.com/d/msgid/elasticsearch/11c3c3af-0814-43ea-b853-22182450a601%40googlegroups.com?utm_medium=email&utm_source=footer>
> .
> For more options, visit https://groups.google.com/d/optout.
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/elasticsearch/etPan.53359057.140e0f76.16bdd%40MacBook-Air-de-David.local<https://groups.google.com/d/msgid/elasticsearch/etPan.53359057.140e0f76.16bdd%40MacBook-Air-de-David.local?utm_medium=email&utm_source=footer>
> .
>
> For more options, visit https://groups.google.com/d/optout.
>
--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CALAhT_g2j%3Ddf-hGJb7k%3DGOxg8QeW1GBNWQNPuQEb8E%2BpSGGpSg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.
