CODEWITHSUNDEEP
elasticsearch
Marcel Emblazoned
Marcel Emblazoned

Reputation: 633

Elasticsearch unexpected results when deleting by filtered query

I am trying to delete a set of documents that do not match a field with a certain value by sending the following data through a DELETE request to "localhost:9200/products/phone":

{
  "query": {
    "filtered": {
      "query": {
        "match_all": []
      },
      "filter": {
        "bool": {
          "must": [],
          "should": [],
          "must_not": {
            "term": {
              "batch": 1433585920
            }
          }
        }
      }
    }
  }
}

But this query ends up deleting ALL documents of the /products/phone type, including the documents that have the 1433586041 value in 'batch'. What am I doing wrong?

Upvotes: 1

Views: 447

Answers (1)

pickypg
pickypg

Reputation: 22332

Deleting in the way that you are doing it is deleting the index's type, phone:

curl -XDELETE host:9200/products/phone -d '{ ... }'

The request payload is ignored in this case. You need to use the _query endpoint:

curl -XDELETE host:9200/products/phone/_query -d '{
  "query": {
    "filtered": {
      "filter": {
        "bool": {
          "must_not": {
            "term": {
              "batch": 1433585920
            }
          }
        }
      }
    }
  }
}'

All of that said, Delete By Query is a little bit trappy and I suggest that you do not use it. The goal is to completely rewrite it, but that has not happened yet -- the suggestion is therefore to use the Scan/Scroll API to find documents matching your filter, then delete them using the Bulk API by ID. It's more effort, but it will be a better solution for cluster stability until the Delete By Query endpoint is rewritten.

Upvotes: 1

Related Questions