CODEWITHSUNDEEP
c#elasticsearchlogstashnest
James
James

Reputation: 11

Delete old elasticsearch logs from a specific type

I am using elasticsearch to store logs from more than one system. I seperate the logs from different systems by using a different _type name for each system log. I am trying to write an old-logs-deleter which will delete logs that are older than some date... When I use Nest to do this, It seems that I delete all the types and not only the one i specified.

var client = new ElasticClient(new ConnectionSettings(new Uri("http://localhost:9200"),"someindex");
client.deleteByQuery(new DeleteByQueryRequest
{
   AllIndices = true,
   AllType = true,
   Q = "_type:someType",
   Query = new QueryContainer(new RangeQuery
   {
       Field = new PropertyPathMarker
       {
           Name = "@timestamp"
       },
       LowerThan = dateToSaveFrom.ToString("O")
   })
}

I tried so many times with different variations and it just doesn't work as expected. What am I doing wrong?

Upvotes: 1

Views: 536

Answers (2)

Greg Marzouka
Greg Marzouka

Reputation: 3325

Q and Query are mutually exclusive here, and Query is taking precedence.

Since you're explicitly setting AllTypes = true, and specifying both Q and Query, Q is ignored and the RangeQuery is running across all your types.

Instead, just drop Q and use Types to specify only the type(s) you wish to delete.

new DeleteByQueryRequest
{
   AllIndices = true,
   Types = new TypeNameMarker [] { "someType" },
   Query = new QueryContainer(new RangeQuery
   {
       Field = new PropertyPathMarker
       {
           Name = "@timestamp"
       },
       LowerThan = dateToSaveFrom.ToString("O")
   })
}

Upvotes: 2

Vineeth Mohan
Vineeth Mohan

Reputation: 19253

You can do it directly using curl as below.

curl -XDELETE 'http://localhost:9200/index/type/_query' -d '{
    "match_all" : {}
}'

Here by pointing to the index and type , you can remove the type.

Upvotes: 0

Related Questions