How to delete a test record from elastic search - elasticsearch

I've been testing my website and notice the elastic search has indexed those test records.
My Question, how can I query elasticsearch to delete the test record?


Just issue a HTTP POST in the following model :
POST /{index/_delete_by_query
{
"query": {
"match": {
"field": "value"
}
}
}

Related

Delete all index except one/some in Elasticsearch?

Is there any way to delete all indices except one?
We can use the metadata _index of document in a GET request:
GET _count
{
"query": {
"match": {
"_index": "indexname"
}
}
}
The above query doesn't make sense but just to show that we can use _index inside a query I have mentioned it.
I have tried the below query, but I guess _all API doesn't support query.
DELETE _all
{
"query" : {
"bool" : {
"must_not" : [
{
"match": {
"_index": "indexname"
}
}
]
}
}
}
Is there any way to delete all indices except one/some without using bulk API ?

Try to use multiple indices syntax. You can specify all indices with * and then exclude some of them with -.
Suppose we need to remove all indices except foo and bar, so the HTTP request should be
curl -X DELETE -i 'http://{server}:{port}/*,-foo,-bar'

ElasticSearch remove all documents with over 1000 fields

I'm getting this error:
While updating a dev ElasticSearch DB from a LIVE one. I believe it is being caused because the live DB is sending documents with over 1000 fields in them and the dev DB index.mapping.total_fields.limit is set to 1000
I know I can up the fields limit, but for now I would like to just remove all documents with 1000 or more fields.
I'm guessing make a Postman call to the _delete_by_query API with something like:
{
"query": {
"range": {
"fields": {
"gt": 1000
}
}
}
}
Does anyone know of a simple query that can accomplish this?

You can run a query like this against the LIVE cluster:
POST logger/_delete_by_query
{
"query": {
"script": {
"script": {
"source": "params._source.size() > 1000"
}
}
}
}
Provided you don't have nested fields/objects, this will delete all documents having more than 1000 fields.

Scope Elasticsearch Results to Specific Ids

I have a question about the Elasticsearch DSL.
I would like to do a full text search, but scope the searchable records to a specific array of database ids.
In SQL world, it would be the functional equivalent of WHERE id IN(1, 2, 3, 4).
I've been researching, but I find the Elasticsearch query DSL documentation a little cryptic and devoid of useful examples. Can anyone point me in the right direction?

Here is an example query which might work for you. This assumes that the _all field is enabled on your index (which is the default). It will do a full text search across all the fields in your index. Additionally, with the added ids filter, the query will exclude any document whose id is not in the given array.
{
"bool": {
"must": {
"match": {
"_all": "your search text"
}
},
"filter": {
"ids": {
"values": ["1","2","3","4"]
}
}
}
}
Hope this helps!

As discussed by Ali Beyad, ids field in the query can do that for you. Just to complement his answer, I am giving an working example. In case anyone in the future needs it.
GET index_name/_search
{
"query": {
"bool": {
"must": [
{
"match": {
"field": "your query"
}
},
{
"ids" : {
"values" : ["0aRM6ngBFlDmSSLpu_J4", "0qRM6ngBFlDmSSLpu_J4"]
}
}
]
}
}
}

You can create a bool query that contains an Ids query in a MUST clause:
https://www.elastic.co/guide/en/elasticsearch/reference/2.0/query-dsl-ids-query.html
By using a MUST clause in a bool query, your search will be further limited by the Ids you specify. I'm assuming here by Ids you mean the _id value for your documents.

According to es doc, you can
Returns documents based on their IDs.
GET /_search
{
"query": {
"ids" : {
"values" : ["1", "4", "100"]
}
}
}

With elasticaBundle symfony 5.2
$query = new Query();
$IdsQuery = new Query\Ids();
$IdsQuery->setIds($id);
$query->setQuery($IdsQuery);
$this->finder->find($query, $limit);

You have two options.
The ids query:
GET index/_search
{
"query": {
"ids": {
"values": ["1, 2, 3"]
}
}
}
or
The terms query:
GET index/_search
{
"query": {
"terms": {
"yourNonPrimaryIdField": ["1", "2","3"]
}
}
}
The ids query targets the document's internal _id field (= the primary ID). But it often happens that documents contain secondary (and more) IDs which you'd target thru the terms query.
Note that if your secondary IDs contain uppercase chars and you don't set their field's mapping to keyword, they'll be normalized (and lowercased) and the terms query will appear broken because it only works with exact matches. More on this here: Only getting results when elasticsearch is case sensitive

Query fetching case-sensitive results in elasticsearch

I have a field like this in my indexed documents
"screen_name : "9GAG"
And this is my query:
{
"query": {
"term": {
"screen_name": "9gag"
}
}
}
Im getting zero hits. But when I replace "9gag" with "9GAG" it works fine. Why is this happening and how can this be fixed?

Why is my very simple ElasticSearch query failing, SearchPhaseExecutionException

Im trying to do a search for "dog chew" in the invention-title field in my PatentGrants type.
query url: POST http://localhost:9200/patents/patentGrants/_search
query body:
{
"query": {
"match_all": {
"invention-title": "dog chew"
}
}
}
Below is a picture of the data in my patents index and below that is a picture of my query and the error message.

Try this:
{
"query": {
"match": {
"inventionTitle": "dog chew"
}
}
}
The field name in the screenshot is inventionTitle not invention-title.
https://www.elastic.co/guide/en/elasticsearch/reference/1.6/query-dsl-match-all-query.html - use match instead of match_all. match_all doesn't accept a search query.

Resources