CODEWITHSUNDEEP
curlelasticsearchgraylog2
Curl User
Curl User

Reputation: 115

Elasticsearch - Remove old source in GrayLog2

Firstly I have to say im newbie at curl so Im asking here

I have some sources in GrayLog2: https://i.sstatic.net/xkelZ.jpg

and want remove them all

Used curl to delete "12:00:02:" source

curl -XDELETE 'http://127.0.0.1:9200/graylog2_*/message/_query' -d ' {"query_string" : { "default_field" : "host", "query" : "12:00:02:" } }'

but got failture

{"_indices":{"graylog2_0":{"_shards":{"total":1,"successful":0,"failed":1,"failures":[{"index":"graylog2_0","shard":0,"reason":"QueryParsingException[[graylog2_0] request does not support [query_string]]"}]}}}}

Anyone can help me with properly curl command ?

Upvotes: 0

Views: 4105

Answers (1)

Val
Val

Reputation: 217334

You're just missing the first query keyword. Change your query to this

curl -XDELETE 'http://127.0.0.1:9200/graylog2_*/message/_query' -d ' {"query": {"query_string" : { "default_field" : "host", "query" : "12:00:02:" } } }'
                                                                         ^
                                                                         |
                                                                  this was missing

Also you can use this equivalent query 

curl -XDELETE 'http://127.0.0.1:9200/graylog2_*/message/_query?q=host:"12:00:02:"'

But if you want to delete them all you can also use this query

curl -XDELETE 'http://127.0.0.1:9200/graylog2_*/message/_query?q=host:*'

Upvotes: 1

Related Questions