Search code examples
elasticsearchkibana

Elastic_search function for deleting all records except a spastic set


I want to delete all records from a specified index except for a specific set. Is there such a function in elastic_search?

I tried to use delete_by_query function but could not get it to work as desired. Below is a snippet of what I tried. I basically want to have an array of ids instead of only one id at a time.

POST /myindex/_delete_by_query
{
  "query": {
    "bool": {
      "must_not": [
        {
          "match": {
            "id": {
              "query": [12345,67890]
            }
          }
        }
      ]
    }
  }
}

I am new to elastic_search, but in SQL terms I want to something like the following query:

DELETE * FROM <my-index> WHERE <id> != <listOfIds>

Solution

  • Good start!! You can do it like you suggest with a terms query:

    POST /myindex/_delete_by_query
    {
      "query": {
        "bool": {
          "must_not": [
            {
              "terms": {
                "id": [
                  12345,
                  67890
                ]
              }
            }
          ]
        }
      }
    }