Hi everyone I have 100 index into my elasticsearch and I want to delete them with one query. They all begin with myindex:
myindex-1
myindex-2
myindex-3
myindex-4
.
.
.
myindex-100
when I try this query, it does not work:
curl -XDELETE http://localhost:9200/myindex*
I get:
{"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"Wildcard expressions or all indices are not allowed"}],"type":"illegal_argument_exception","reason":"Wildcard expressions or all indices are not allowed"},"status":400}
Do you have any idea?
Elasticsearch documentation says:
The delete index API can also be applied to more than one index, by either using a comma separated list, or on all indices (be careful!) by using _all or *as index.
In order to disable allowing to delete indices via wildcards or _all, set action.destructive_requires_namesetting in the config to true. This setting can also be changed via the cluster update settings api.
So this could work if you have a predefined number of indices to delete:
curl -XDELETE http://localhost:9200/myindex-1,myindex-2,myindex-3,myindex-4
If you want to use wildcards you'll have to update the configuration as stated above
You could use The following in kibana dev tool:
PUT /_cluster/settings
{
"transient": {
"action.destructive_requires_name":false
}
}
Related
I have been exploring Elastic Search lately.
I have been going through aliases. I see ES provides an API to create multiple aliases to a single index like below:
{ "actions" : [{ "add" : { "indices" : ["test1", "test2"], "alias" : "alias1" } }] }
Refer: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html#indices-aliases
I'm wondering what is the use case of this.
Won't the queries on aliases get split if an alias point to multiple indices?
I have tried getting the info, but failed to do so as everywhere it's being explained how to acheive this but not the use case.
Directing me to a resource where I could get more info would also help.
A possible use case is when your application has to switch from an
old index to a newindex with zero downtime.
Let's say you want to reindex an index because of some reasons and you're not using aliases with your index then you need to update your application to use the new index name.
How this is helpful?
Assume that your application is using the alias instead of an index name.
Let's create an index:
PUT /my_index
Create its alias:
PUT /my_index/_alias/my_index_alias
Now you've decided to reindex your index (maybe you want to change the existing mapping).
Once documents have been reindexed correctly, you can switch your alias to point to the new index.
Note: You need to remove the alias from the old index at the same time as we add it to the new index. You can do it using _aliases endpoint atomically.
A good read : elastic
As per your question usage of maintaining two aliases for a single index:
Create “views” on a subset of the documents in an index.
Using multiple indices having same alias:
Group multiple indices under same name, which is helpful if you want to perform a single query on multiple index at the same time.
But you can't insert/index data using this strategy.
Lets say that you have to types of events, eventA & eventB. You want to "partition" them by time, so you use alias to map multiple indices (e.g. eventA-20220920) to one alias ('eventA' in this case). And you want make one alias for all the event types, so you need to give all the eventA-* and eventB-* indices another alias 'event'.
That way when you add a third type of event (eventC) you can just add them to the 'event' alias and don't change your queries
I am trying to delete documents from elastic search which have certain criteria to filter from the index using deleteQueryBuilder.
I am not sure about deleteQueryBuilder. However, if you are able to search your record (as you mentioned, some criteria), then replace your GET/PUT/POST etc to DELETE only which will delete your filtered records.
Try this for deleting entire index.i think there is no possibility of deleting documents
1.you can delete using id
$ curl -XDELETE 'http://localhost:9200/twitter/tweet/1'
2.or delete entire index
$ curl -XDELETE 'http://localhost:9200/twitter/'
In Jest I you want to use the:
DeleteByQuery.Builder(query)
method .. the Delete builder method is for id's only
I have hundreds of indexes and I want to fetch only a given field from every record under these indexes. I can do the following
curl -XGET 'http://localhost:9200/cms-2016-03-30/job/_search?pretty=true&field=CMSDataset'
This unfortunately returns a lot of things I don't want and also doesn't give me all the records (~10^6).
Also, there are many cms-* style indexes, and I want to parse through all of them and get only this field. How do I do this?
You need to use source filtering instead of fields (which is deprecated)
curl -XGET 'http://localhost:9200/cms-2016-03-30/job/_search?pretty=true&_source=CMSDataset'
^
|
change this
From the official documentation:
The fields parameter is about fields that are explicitly marked as stored in the mapping, which is off by default and generally not recommended. Use source filtering instead to select subsets of the original source document to be returned.
UPDATE
You can use the size parameter (e.g. 100) in order to return more records (by default it's 10) and then simply use * as the index name:
curl -XGET 'http://localhost:9200/*/_search?pretty=true&size=100&_source=CMSDataset'
I've updated to ElasticSearch 2.1. Deleting a mapping type is not supported anymore since 2.0 onward.
Before, it was very useful to simply remove a type, and created it again.
So, the question is waht should I do in order to reach it out on ElasticSearch 2.1?
Imagine I've an index idx with a type tp.
I supose I shall use alias, however I don't know how to do it.
Does exists alias for index-level? Does exist alias for type-level?
Oh,since 2.x,the elasticsearch cannot delete the mapping .It is no longer possible to delete the mapping for a type. Instead you should delete the index and recreate it with the new mappings.
[You can refer to the link as follow ! ]
https://www.elastic.co/guide/en/elasticsearch/reference/2.2/indices-delete-mapping.html
As mentioned in my answer to your other question, you can proceed in a similar way as before, just on a totally new index (which I called myindex below):
First create a new index with your mapping
curl -XPUT localhost:9200/myindex -d '{
"mappings": {
"mytype": {
"properties": {
...
}
}
}
}'
Then re-index your data in your new index
curl -XPUT localhost:9200/myindex/mytype/1 -d '{"field":"value"}'
Finally, you can run your queries on your new index myindex, you can also delete the previous index:
curl -XDELETE localhost:9200/oldindex
I create an index "myindex" with a specified document type "mytype". I am able to delete the index, but it appears that "mytype" still exists without being tied to the index.
How do I get rid of "mytype"?
If you really deleted the index, the mapping in this index should not exist anymore.
Do you have any other index in your cluster with a similar type name?
To answer to the question: How to delete document types in elasticsearch?, use Delete Mapping API:
curl -XDELETE http://localhost:9200/index/type
EDIT: From elasticsearch 2.0, it won't be possible anymore. See Mapping changes. You will have to install the Delete By Query plugin and run a query which will remove your documents but the mapping will still exist. So it will most likely better to reindex your documents in another index without the old type.
But as #mguillemin and #javanna said, when you delete an index, every mapping attached to this index is deleted as well:
curl -XDELETE http://localhost:9200/index
You can use _delete_by_query path to delete type.
POST index-name/type-name/_delete_by_query
{
"query": {
"match": {
"message": "some message"
}
}
}
For further reading see docs
In the latest version of elastic search, they no longer support deleting document types. It's mentioned in the documentation
It is no longer possible to delete the mapping for a type. Instead you
should delete the index and recreate it with the new mappings.
You don't even need to specify the request body. Just
curl -XPOST http://<host>:9200/<index>/<type>/_delete_by_query