That example is unclear because it is not clearly stated that "twitter" is the name of an indice, and what does the "tweet" part stand for in the url.
Giving an example in the following form would have been much more clearer IMHO: curl -XDELETE 'http://localhost:9200/my_indice_name/_query because when reading the example you don't know where are the mandatory parts and what you have to adapt. Same goes for the examples with url parameter *?q=user:kimchy* I found no further explanation about what to expect, but I tried with *?q=idsession:A7C571A26A606B210563EDBAF1AC7A* and got nothing as expected, I think the docs are useful memo for the ones already used to ES, but for an outsider there are lot of things that are not as obvious as they would seem. Anyway I see your point. Thank you for the reply, I will keep that in mind next time we have the problem. Aldian PS: BTW how do you insert code in google groups? 2014-04-03 10:37 GMT+02:00 David Pilato <[email protected]>: > Look at the doc: > http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/docs-delete-by-query.html#docs-delete-by-query > > Missing a _query at the end: > > $ curl -XDELETE 'http://localhost:9200/twitter/tweet/_query?q=user:kimchy' > > $ curl -XDELETE 'http://localhost:9200/twitter/tweet/_query' -d '{ > "query" : { > "term" : { "user" : "kimchy" } > } > } > ' > > > -- > *David Pilato* | *Technical Advocate* | *Elasticsearch.com* > @dadoonet <https://twitter.com/dadoonet> | > @elasticsearchfr<https://twitter.com/elasticsearchfr> > > > Le 3 avril 2014 à 10:31:54, Aldian ([email protected]) a écrit: > > Hi > > Yesterday we encountered hibernate bug > https://hibernate.atlassian.net/browse/HHH-3006, which provoked a huge > load of useless logstash traces (there was already 400.000 when we detected > the problem and enforced a more severe log level). So I tried to wipe out > all these useless record from elasticsearch. I reffered to the documentation > > > http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/docs-get.html > > http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/docs-delete-by-query.html > > but could not find an easy way to make a GET, check the results are what I > want to delete, then make a DELETE. If such functionality exists, please > add it to the docs. I ended querying this, which is the query made by > logstash to filter the results I want: > *curl -XGET http://myserver:9200/_all/_search?pretty > <http://myserver:9200/_all/_search?pretty> -d '{ "query": { "filtered": > { "query": { "bool": { "should": [ > { "query_string": { "query": "*" > } } ] } }, "filter": { "bool": > { "must": [ { "fquery": { > "query": { "query_string": { "query": > "idsession:(\"A7C571A26A606B210563EDBAF1AC7A37\")" > } }, "_cache": true } > } ] } } } }}'* > > Then I tried to use the same query to make a DELETE of the data, but got > several errors and followed the doc in order to have a valid call url. I > ended with this: > * curl -XDELETE http://myserver:9200/logstash-2014.04.02?pretty > <http://myserver:9200/logstash-2014.04.02?pretty> -d '{ "query": { > "filtered": { "query": { "bool": { "should": > [ { "query_string": { "query": > "*" } } ] } }, "filter": > { "bool": { "must": [ { "fquery": > { "query": { "query_string": > { "query": > "idsession:(\"A7C571A26A606B210563EDBAF1AC7A37\")" > } }, "_cache": true } > } ] } } } }}'* > > *{* > * "acknowledged" : true* > *}* > > But the result was not as expected: I found out that elasticsearch had > purely ignored the filter and simply deleted all the data from that index. > I let you imagine my frustration when I realized that rather than spending > a lot of hours experimenting and trying to apply the docs, I could have > just made a rm -rf somewhere and got the same disappointing result in no > time. > > So now that the big failure is done, I would like to know how I should > have done. There must be a way to test a query before actually sending the > delete, right? > > Thanks for reading > > Aldian > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > > To view this discussion on the web visit > https://groups.google.com/d/msgid/elasticsearch/8920d534-d09b-4867-b097-6938c17040ac%40googlegroups.com<https://groups.google.com/d/msgid/elasticsearch/8920d534-d09b-4867-b097-6938c17040ac%40googlegroups.com?utm_medium=email&utm_source=footer> > . > For more options, visit https://groups.google.com/d/optout. > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > https://groups.google.com/d/topic/elasticsearch/Js6X5yxjAeM/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/elasticsearch/etPan.533d1de1.5092ca79.16bdd%40MacBook-Air-de-David.local<https://groups.google.com/d/msgid/elasticsearch/etPan.533d1de1.5092ca79.16bdd%40MacBook-Air-de-David.local?utm_medium=email&utm_source=footer> > . > > For more options, visit https://groups.google.com/d/optout. > -- Cordialement, Aldian -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAECUaLyrJJ%2BkxSHKCX2Na%2BSGsO7s_KPpwdrvVvgg-YVkyni5jQ%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
