CODEWITHSUNDEEP
elasticsearch
Stpete111
Stpete111

Reputation: 3427

Delete 200k+ documents from ElasticSearch using Delete By Query

ElasticSearch 6.2 - I have approximately 216,000 documents I need to delete from one of our ElasticSearch indexes. I have a document number for every one of the documents I need to delete.

I have only ever deleted by single document as such:

DELETE: http://{{elasticip}}:9200/{{index}}/_doc/101

How can I accomplish deleting all 216,000 documents at once, given that I know all 216,000 values for the _id field of the documents?

I have used update_by_query in ElasticSearch before and I see there is in fact a delete_by_query function available as well, but I've never attempted it. So let's say the documents I need to delete are id's 1,2,3,4,5, and assuming the call looks like this:

POST http://{{elasticip}}:9200/{{index}}/_delete_by_query

how would the body look?

EDIT 1: Per answer from @nitzien, I have tried the following two calls:

POST http://{{elasticip}}:9200/{{index}}/_delete_by_query

{
    "query": {
        "ids" : {
            "type" : "_doc",
            "values" : ["1", "2", "3", "4", "5"]
        }
    }
}

AND

POST http://{{elasticip}}:9200/{{index}}/_delete_by_query

{
    "query": {
        "ids" : {
            "type" : "_id",
            "values" : ["1", "2", "3", "4", "5"]
        }
    }
}

However, in both cases, I get "deleted": 0" in the response.

I have confirmed that these 5 ids definitely exist in the index, and I can successfully delete them using a DELETE statement, one-by-one.

EDIT 2 - problem solved - my doc type in this index is not _doc it's _ssldoc therefore that had to be updated in the query that @nitzien provided. Marked nitzien's answer as answer. Thanks.

Upvotes: 0

Views: 250

Answers (1)

nitzien
nitzien

Reputation: 1267

You can use a query like this to delete ids. Please remember to take a backup of elasticsearch index or snapshot before doing this. :)

Upvotes: 1

Related Questions