Delete the document in elasticsearch

Question

I want to delete the document in elasticserach by timestamp and one of the custom field "cu_hostname". I want to remove all the documents which are in the specific time stamp which have the value "cu_hostname=abc"

I have written a query for timestamp as below:

POST filebeat-perf-1/_delete_by_query
{
"query":{
"range": {
"@timestamp": {
"gte": "1510511400000",
"lte": "1510597799000"
}
}
}
}

and deleting the custom field:

  curl -XPOST '10.193.104.42:9200/filebeat-perf-1/_delete_by_query?conflicts=proceed&pretty' -H 'Content-Type: application/json' -d'
    {
    "query": {
    "wildcard": {
    "cu_hostname": "abc"
    }
    }
    }

How to combine both this query?

Val · Accepted Answer · 2017-11-21 06:15:13Z

2

You simply need to combine both with a bool/filter query:

POST filebeat-perf-1/_delete_by_query
{
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": "1510511400000",
              "lte": "1510597799000"
            }
          }
        },
        {
          "wildcard": {
            "cu_hostname": "abc"
          }
        }
      ]
    }
  }
}

answered Nov 21, 2017 at 6:15

Val

218k14 gold badges376 silver badges383 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Delete the document in elasticsearch

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related