json 在 elasticsearch 中删除超过 30 天的文档
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/36288078/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Delete documents older than 30 days in elasticsearch
提问by ACKflow
I want to delete documents in my elasticsearch index which are older than 30 days.
我想删除我的弹性搜索索引中超过 30 天的文档。
Any ideas?
有任何想法吗？
EDIT:
编辑：
I want this to happen automatically - no document in my index shoudl be older than 30 days. So, in my opinion there are 2 options: either using curator or DELETE requests.
我希望这会自动发生 - 我的索引中的任何文档都不应超过 30 天。所以，在我看来有两种选择：使用 curator 或 DELETE 请求。
I have tried both, but i failed. Somehow i have to create a filter which filters all documents older than 30 days and deletes them, when i am using DELETE http statement.
我两个都试过，但都失败了。不知何故，当我使用 DELETE http 语句时，我必须创建一个过滤器来过滤所有超过 30 天的文档并删除它们。
I tried with curator, but curator (as far as i understood this) deletes only whole indices. When attempting to delete indices older than 30 days with curator, my timestamp causing errors.My moment.jspattern looks like this"MMMM Do YYYY, HH:mm:ss.SSS".
我尝试使用 curator，但是 curator（据我所知）只删除整个索引。当尝试使用 curator 删除超过 30 天的索引时，我的时间戳会导致错误。我的moment.js模式如下所示"MMMM Do YYYY, HH:mm:ss.SSS"。
EDIT 2: I added the following to my logstash configuration:
编辑 2：我在我的 logstash 配置中添加了以下内容：
elasticsearch
{
hosts => ["http://localhost:9200"]
index => "logstash-%{type}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
So logstash creates for every type and every day a particular index. Now i can use curator to delete the indices older than a specific date.
因此，logstash 为每种类型和每天创建一个特定的索引。现在我可以使用 curator 删除早于特定日期的索引。
Problem solved imho.
问题解决了恕我直言。
回答by Кирилл Полищук
You can use DELETEquery for that:
https://www.elastic.co/guide/en/elasticsearch/reference/1.6/docs-delete-by-query.htmlin example the query will delete everything older than: 2016-02-29
您可以使用DELETE查询：https:
//www.elastic.co/guide/en/elasticsearch/reference/1.6/docs-delete-by-query.html例如查询将删除所有早于：2016-02- 29
DELETE index_name/_query
{
"query": {
"filtered": {
"query": {
"query_string": {
"query": "*"
}
},
"filter": {
"range": {
"@timestamp": {
"lte": "2016-02-29"
}
}
}
}
}
}
Update >6.4
更新>6.4
According to the official documentation, this function has been deprecated and replaced by _delete_by_query
根据官方文档，此功能已被弃用并由 _delete_by_query 取代
POST index_name/_delete_by_query
{
"query": {
"match": {
"message": "some message"
}
}
}
https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html
