Elasticsearch delete a document based on a field value

Question

I am new to Elasticsearch and trying to figure out a way to delete a document that contains a field with timestamp as its value.

I have a document with a field called lastmodifiedtime. This field is of type long and is being used to store the timestamp (i.e number of milliseconds since EPOCH. ex, 1486709502).

Now I have a usecase where I need to delete all the documents that are having lastmodifiedtime older than one day. So I find out the timstamp value corresponding to the one day older time and then try to delete the documents.

I tried REST call as below

DELETE http://localhost:9200/testindex/testtype/_query
"query": {
    "term" : {
        "lastmodifiedtime" : {
        "lte": 1486709504
        }
    }
 }

But getting the following response:

{
    "found": false,
    "_index": "testindex",
    "_type": "testtype",
    "_id": "_query",
    "_version": 4,
    "result": "not_found",
    "_shards":
    {
        "total": 2,
        "successful": 1,
        "failed": 0
    }
}

Could you please help me how to deal with this scenario?

This just means that your query is not returning any matches. Are you sure documents exist (just run a query for documents lastmodifiedtime lte 1486709504 and check if it returns results. — Imran Saeed
– Imran Saeed, Commented Apr 6, 2017 at 10:09
If you are using >= 5.2 of elasticsearch try this: elastic.co/guide/en/elasticsearch/reference/current/… — rad11
– rad11, Commented Apr 6, 2017 at 10:21
1486709504 is the number of seconds, 1486709504000 is the number of milliseconds. Try it out. — Val
– Val, Commented Apr 6, 2017 at 10:25
@rad11: This is elasticsearch 5.2.2 and I did try delete by query api too. But no luck. — Santosh M K
– Santosh M K, Commented Apr 6, 2017 at 11:21
@Val : My bad. The value stored in document is 1486709504 and I am trying to query using similar value. — Santosh M K
– Santosh M K, Commented Apr 6, 2017 at 11:23

user3775217 · Accepted Answer · 2017-04-06 11:35:13Z

3

you can use delete_by query api

POST http://localhost:9200/testindex/testtype/_delete_by_query
{
  "query": {
    "range": {
      "lastmodifiedtime": {
        "lte": 1486709504
      }
    }
  }
}

Thanks

edited Apr 6, 2017 at 11:35

answered Apr 6, 2017 at 10:32

user3775217

4,8231 gold badge26 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Santosh M K Over a year ago

I tried this but no luck :(. Getting the following error: { "error": { "root_cause": [ { "type": "parse_exception", "reason": "Failed to derive xcontent" } ], "type": "parse_exception", "reason": "Failed to derive xcontent" }, "status": 400 }

user3775217 Over a year ago

ahh,,, are you trying to do a range query?

user3775217 Over a year ago

i have edited my answer, this should work now for you

user3775217 Over a year ago

glad this worked for you, can you please accept this answer as correct

Collectives™ on Stack Overflow

Elasticsearch delete a document based on a field value

1 Answer 1

4 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Related