CODEWITHSUNDEEP
elasticsearch
cmac
cmac

Reputation: 3268

ElasticSearch remove all documents with over 1000 fields

I'm getting this error:

enter image description here

While updating a dev ElasticSearch DB from a LIVE one. I believe it is being caused because the live DB is sending documents with over 1000 fields in them and the dev DB index.mapping.total_fields.limit is set to 1000

I know I can up the fields limit, but for now I would like to just remove all documents with 1000 or more fields.

I'm guessing make a Postman call to the _delete_by_query API with something like:

{
  "query": {
    "range": {
      "fields": {
        "gt": 1000
      }
     }
  }
}

Does anyone know of a simple query that can accomplish this?

Upvotes: 1

Views: 259

Answers (1)

Val
Val

Reputation: 217274

You can run a query like this against the LIVE cluster:

POST logger/_delete_by_query
{
  "query": {
    "script": {
      "script": {
        "source": "params._source.size() > 1000"
      }
    }
  }
}

Provided you don't have nested fields/objects, this will delete all documents having more than 1000 fields.

Upvotes: 2

Related Questions