Elasticsearch 2.2: delete documents on demand

Question

I am trying to delete some documents from Elasticsearch.

I have the following queries:

IDX=logstash-2016.02.13

curl -XGET "http://localhost:9200/$IDX/fg400/_search" -d '{
  "query" : {
    "term" : {
      "action" : "start"
    }
  }
}' | python -m json.tool

This read request gives:

{
    "_shards": {
        "failed": 0,
        "successful": 5,
        "total": 5
    },
    "hits": {
        "hits": [
            {
                "_id": "AVLcXJrLLFxTvjNEoqDO",
                "_index": "logstash-2016.02.13",
                "_score": 3.4307306,
                "_source": {
                    "@timestamp": "2016-02-13T20:40:00.000Z",
                    "@version": "1",
                    "action": "start",   <------
...
        ],
        "max_score": 3.4307306,
        "total": 146511
    },
    "timed_out": false,
    "took": 13
}

Now I say this because I want to DELETE some of them:

curl -XDELETE "http://localhost:9200/${IDX}/fg400/_query" -d '{
  "query" : {
    "term" : {
        "action" : "start"
    }
  }
}' | python -m json.tool

And this gives the following result:

{
    "_id": "_query",
    "_index": "logstash-2016.02.13",
    "_shards": {
        "failed": 0,
        "successful": 1,
        "total": 2
    },
    "_type": "fg400",
    "_version": 1,
    "found": false
}

Why can't I delete what I found before using GET?

Answer 1

Delete on demand plugin was included in 2.0 or more. To use this functionality, you will need to install the plugin https://www.elastic.co/guide/en/elasticsearch/plugins/2.2/delete-by-query-usage.html

Or what Elastic recommends, you make a request to get the identifiers, and then do the deletion by identifier based on the results.