212

I know one can delete all documents from a certain index via deleteByQuery.

Example:

curl -XDELETE 'http://localhost:9200/twitter/tweet/_query' -d '{
    "query" : {
        "term" : { "user" : "kimchy" }
    }
}'

But i have NO term and simply want to delete all documents from that index, no matter what term. What is best practice to achieve this? Empty term does not work.

Link to deleteByQuery

17 Answers 17

199

I believe if you combine the delete by query with a match all it should do what you are looking for, something like this (using your example):

curl -XDELETE 'http://localhost:9200/twitter/tweet/_query' -d '{
    "query" : { 
        "match_all" : {}
    }
}'

Or you could just delete the type:

curl -XDELETE http://localhost:9200/twitter/tweet

Note: XDELETE is deprecated for later versions of ElasticSearch

8
  • 10
    If you are having custom mappings; do note that the second option will delete the type and its mappings. So don't forget to remap the index type after deleting. Or else you will be messed up. Commented Sep 15, 2015 at 6:14
  • 25
    Ftr: in Elasticsearch 2.0 the delete by query API has been removed from the core and now lives in a plugin.
    – dtk
    Commented Nov 16, 2015 at 14:41
  • 2
    It is not recommended to delete records by this way.Here statement from the docs: " it is problematic since it silently forces a refresh which can quickly cause OutOfMemoryError during concurrent indexing" elastic.co/guide/en/elasticsearch/reference/1.7/…
    – usef_ksa
    Commented Jan 14, 2016 at 9:51
  • 3
    Ftr: The delete by query plugin will be back into ES core as of version 5.
    – Val
    Commented Jun 15, 2016 at 6:00
  • 11
    If you get "No handler found for uri ... " error, use curl -XPOST 'localhost:9200/twitter/tweet/_delete_by_query?conflicts=proceed&pretty' -d' { "query": { "match_all": {} } }'
    – Iqbal
    Commented Nov 24, 2016 at 9:28
113

The Delete-By-Query plugin has been removed in favor of a new Delete By Query API implementation in core. Read here

curl -XPOST 'localhost:9200/twitter/tweet/_delete_by_query?conflicts=proceed&pretty' -H 'Content-Type: application/json' -d'
{
    "query": {
        "match_all": {}
    }
}'
3
  • 1
    Worked for me on es 5.4 Commented May 10, 2017 at 20:23
  • 2
    Worked for me on ES 6.1.1
    – Sebastian
    Commented Jul 5, 2018 at 9:52
  • 8
    For ES 6+ you also need -H 'Content-Type: application/json'
    – OMRY VOLK
    Commented Nov 29, 2018 at 15:40
81

From ElasticSearch 5.x, delete_by_query API is there by default

POST: http://localhost:9200/index/type/_delete_by_query

{
    "query": { 
        "match_all": {}
    }
}
1
  • This is nice because it works for child nodes (some of the other answers fail in that case due to "routing_missing_exception")
    – dnault
    Commented Jan 25, 2018 at 20:08
30

You can delete documents from type with following query:

POST /index/type/_delete_by_query
{
    "query" : { 
        "match_all" : {}
    }
}

I tested this query in Kibana and Elastic 5.5.2

22

Since ElasticSearch 7.x, delete-by-query plugin was removed in favor of new Delete By Query API.

The curl option:

curl -X POST "localhost:9200/my-index/_delete_by_query" -H 'Content-Type: application/json' -d' { "query": { "match_all":{} } } '

Or in Kibana

POST /my-index/_delete_by_query
{
  "query": {
    "match_all":{}
  }
}
1
  • There are so many other answers here that still has the old type in the path like http://localhost:9200/index/type/_delete_by_query, just for a note, the type was removed in 6.0 since you can only store one type per index and the type is assumed _doc as default. Just like said in stackoverflow.com/a/69210693/1560094 Commented Sep 25, 2023 at 11:50
16

Torsten Engelbrecht's comment in John Petrones answer expanded:

curl -XDELETE 'http://localhost:9200/twitter/tweet/_query' -d 
  '{
      "query": 
      {
          "match_all": {}
      }
   }'

(I did not want to edit John's reply, since it got upvotes and is set as answer, and I might have introduced an error)

1
  • 1
    @ChristopheRoussy No without extra plugin, see comments on John Petrone answer
    – rsilva4
    Commented Jul 28, 2016 at 11:05
13

Starting from Elasticsearch 2.x delete is not anymore allowed, since documents remain in the index causing index corruption.

2
  • 1
    So what is the solution ? Commented Jun 13, 2016 at 15:44
  • 1
    I use a solution based on alias for index. The main idea is to create new index each time like news1, news2 and so on and setup an alias for the current active index to the news path. Of course the name of the index is only as example. Here you can find a complete example for [ index alias](elastic.co/guide/en/elasticsearch/reference/current/…) and article which explains a case study. Commented Jun 18, 2016 at 10:51
11

The above answers no longer work with ES 6.2.2 because of Strict Content-Type Checking for Elasticsearch REST Requests. The curl command which I ended up using is this:

curl -H'Content-Type: application/json' -XPOST 'localhost:9200/yourindex/_doc/_delete_by_query?conflicts=proceed' -d' { "query": { "match_all": {} }}'
1
  • 1
    According to the offical docs I had to remove the _doc part of the URL. Commented Jan 23, 2019 at 9:45
8

In Kibana Console:

POST calls-xin-test-2/_delete_by_query
{
  "query": { 
    "match_all": {}
  }
}
5

(Reputation not high enough to comment) The second part of John Petrone's answer works - no query needed. It will delete the type and all documents contained in that type, but that can just be re-created whenever you index a new document to that type.

Just to clarify: $ curl -XDELETE 'http://localhost:9200/twitter/tweet'

Note: this does delete the mapping! But as mentioned before, it can be easily re-mapped by creating a new document.

3
  • 2
    But you delete all mappings configuration whats you have, it's not recommended when you have specific configuration for any mapping, because the dynamic mappings only create basics fields like string, long, etc... Commented Jan 6, 2016 at 19:42
  • 2
    @CarlosRodriguez but any fancy mapping you have should surely be in source control, and very easy to automatically re-apply, as part of the same script that's doing the delete. Commented May 23, 2016 at 20:35
  • This answer directly contradicts the question: "Delete all documents ... WITHOUT deleting type". Please do not make assumptions how easy it is to recreate mapping based on YOUR project. Other projects may have more complex procedures for mapping versioning/migration/etc. Commented Sep 19, 2018 at 4:55
5

Note for ES2+

Starting with ES 1.5.3 the delete-by-query API is deprecated, and is completely removed since ES 2.0

Instead of the API, the Delete By Query is now a plugin.

In order to use the Delete By Query plugin you must install the plugin on all nodes of the cluster:

sudo bin/plugin install delete-by-query

All of the nodes must be restarted after the installation.


The usage of the plugin is the same as the old API. You don't need to change anything in your queries - this plugin will just make them work.


*For complete information regarding WHY the API was removed you can read more here.

2
  • From my experience, DeleteByQuery plugin performs very poorly with a large amount of documents. Tested with ES 2.3.2.
    – ibai
    Commented Aug 26, 2016 at 11:55
  • 1
    @ibai, I used it with ES 2.2.0 on an index contain several million documents and it didn't take long (about the same time with the original delete by query API that was in 1.7). Anyway - I guess there is no much choice here, as the API is no longer valid.
    – Dekel
    Commented Aug 28, 2016 at 1:08
5

You have these alternatives:

1) Delete a whole index:

curl -XDELETE 'http://localhost:9200/indexName'             

example:

curl -XDELETE 'http://localhost:9200/mentorz'

For more details you can find here -https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-delete-index.html

2) Delete by Query to those that match:

curl -XDELETE 'http://localhost:9200/mentorz/users/_query' -d                
    '{
        "query":
            {
                "match_all": {}
            }
    }'

*Here mentorz is an index name and users is a type

5

I'm using elasticsearch 7.5 and when I use

curl -XPOST 'localhost:9200/materials/_delete_by_query?conflicts=proceed&pretty' -d'
{
    "query": {
        "match_all": {}
    }
}'

which will throw below error.

{
  "error" : "Content-Type header [application/x-www-form-urlencoded] is not supported",
  "status" : 406
}

I also need to add extra -H 'Content-Type: application/json' header in the request to make it works.

curl -XPOST 'localhost:9200/materials/_delete_by_query?conflicts=proceed&pretty'  -H 'Content-Type: application/json' -d'
{
    "query": {
        "match_all": {}
    }
}'
{
  "took" : 465,
  "timed_out" : false,
  "total" : 2275,
  "deleted" : 2275,
  "batches" : 3,
  "version_conflicts" : 0,
  "noops" : 0,
  "retries" : {
    "bulk" : 0,
    "search" : 0
  },
  "throttled_millis" : 0,
  "requests_per_second" : -1.0,
  "throttled_until_millis" : 0,
  "failures" : [ ]
}
0
3

Just to add couple cents to this.

The "delete_by_query" mentioned at the top is still available as a plugin in elasticsearch 2.x.

Although in the latest upcoming version 5.x it will be replaced by "delete by query api"

0
2

For future readers:

  • in Elasticsearch 7.x there's effectively one type per index - types are hidden
  • you can delete by query, but if you want remove everything you'll be much better off removing and re-creating the index. That's because deletes are only soft deletes under the hood, until the trigger Lucene segment merges*, which can be expensive if the index is large. Meanwhile, removing an index is almost instant: remove some files on disk and a reference in the cluster state.

* The video/slides are about Solr, but things work exactly the same in Elasticsearch, this is Lucene-level functionality.

0

Elasticsearch 2.3 the option

    action.destructive_requires_name: true

in elasticsearch.yml do the trip

    curl -XDELETE http://localhost:9200/twitter/tweet
-1

If you want to delete document according to a date. You can use kibana console (v.6.1.2)

POST index_name/_delete_by_query
{
      "query" : {
              "range" : {
                 "sendDate" : {
                     "lte" : "2018-03-06"
                              }
                        }
                  }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.