And this comes down to differences in how the query API works across versions. Removing the enclosing 'top leve' query json object fixed it. Thus:
/usr/bin/curl -H Content-Type: application/json -XDELETE http://lcoalhost:9200/graylog2_0/message/_query?pretty=true -d { "range" : { "timestamp" : { "lt" : "2014-04-10 15:07:20.000", "gt" : "2014-04-10 15:06:46.000" } } } On Thursday, 10 April 2014 16:26:43 UTC+1, Robert Logan wrote: > > The GET/_search succeeds, gets a dozen messages: > /usr/bin/curl -H Content-Type: application/json -XGET > http://localhost:9200/graylog2_0/message/_search?pretty=true -d { "query" > : { "filtered" : { "filter" : { "range" : { "timestamp" : { "lt" : > "2014-04-10 15:07:20.000", "gt" : "2014-04-10 15:06:46.000" } } } } } } > > The DELETE/_query fails with: > { > "ok" : true, > "_indices" : { > "graylog2_0" : { > "_shards" : { > "total" : 2, > "successful" : 0, > "failed" : 2 > } > } > } > } > > /usr/bin/curl -H Content-Type: application/json -XDELETE > http://localhost:9200/graylog2_0/message/_query?pretty=true -d { "query" > : { "filtered" : { "filter" : { "range" : { "timestamp" : { "lt" : > "2014-04-10 15:07:20.000", "gt" : "2014-04-10 15:06:46.000" } } } } } } > > On Thursday, 10 April 2014 14:50:06 UTC+1, lennart wrote: >> >> >> http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/docs-delete-by-query.html >> >> >> On Thu, Apr 10, 2014 at 3:42 PM, Robert Logan <[email protected]> >> wrote: >> > I can .. with hair pulled out, but how to make this 'delete' these >> messages >> > for example? >> > >> > #!/bin/bash >> > RANGE='{ >> > "query" : { >> > "filtered" : { >> > "filter" : { >> > "range" : { >> > "timestamp" : { >> > "lt" : "SDATE", >> > "gt" : "EDATE" >> > } >> > } >> > }, >> > "query" : { >> > "match_all" : {} >> > } >> > } >> > } >> > }' >> > >> > SDATE=`date +"%F %H:%M:%S.000" --date="44 minutes ago"` >> > EDATE=`date +"%F %H:%M:%S.000" --date="45 minutes ago"` >> > RANGE=`echo $RANGE | sed "s/SDATE/${SDATE}/"` >> > RANGE=`echo $RANGE | sed "s/EDATE/${EDATE}/"` >> > /usr/bin/curl -XGET >> > "http://localhost:9200/graylog2_0/message/_search?pretty=true"; -d >> "${RANGE}" >> > >> > >> > >> > On Thursday, 10 April 2014 13:46:16 UTC+1, Robert Logan wrote: >> >> >> >> >> >> Can anyone provide me with a sample 'curl' on elasticsearch to return >> >> messages that match the graylog 0.20 database? >> >> >> >> I have wasted half a day trying to do this to get to deleting 'old >> >> messages' but am totally frustrated now. >> >> >> >> >> >> >> ---------------------------------------------------------------------------------- >> >> >> >> >> >> The information in this email is confidential and may be legally >> >> privileged. It is intended solely for the addressee. Access to this >> email >> >> by anyone else is unauthorised. If you are not the intended >> recipient, any >> >> disclosure, copying, distribution or any action taken or omitted to be >> taken >> >> in reliance on it, is prohibited and may be unlawful. >> >> >> >> Policy Expert is a trading name of QMetric Group Limited who is >> authorised >> >> and regulated by the Financial Conduct Authority. The registered >> company >> >> address of QMetric Group Limited is: 32-38 Dukes Place, London, EC3A >> 7LP and >> >> its company registration number is 07151701. >> >> >> > >> > >> ---------------------------------------------------------------------------------- >> >> >> > >> > The information in this email is confidential and may be legally >> privileged. >> > It is intended solely for the addressee. Access to this email by >> anyone >> > else is unauthorised. If you are not the intended recipient, any >> > disclosure, copying, distribution or any action taken or omitted to be >> taken >> > in reliance on it, is prohibited and may be unlawful. >> > >> > Policy Expert is a trading name of QMetric Group Limited who is >> authorised >> > and regulated by the Financial Conduct Authority. The registered >> company >> > address of QMetric Group Limited is: 32-38 Dukes Place, London, EC3A >> 7LP and >> > its company registration number is 07151701. >> > >> > -- >> > You received this message because you are subscribed to the Google >> Groups >> > "graylog2" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. >> > -- ---------------------------------------------------------------------------------- The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Policy Expert is a trading name of QMetric Group Limited who is authorised and regulated by the Financial Conduct Authority. The registered company address of QMetric Group Limited is: 32-38 Dukes Place, London, EC3A 7LP and its company registration number is 07151701. -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
