# Delete Logs from Graylog/Elasticsearch

**URL:** <https://community.graylog.org/t/delete-logs-from-graylog-elasticsearch/6750>\
**Category:** Graylog Central (peer support)\
**Created:** [September 7, 2018, 7:45pm UTC](https://community.graylog.org/t/delete-logs-from-graylog-elasticsearch/6750 "2018-09-07T19:45:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lissaware](https://avatars.discourse-cdn.com/v4/letter/l/e19adc/32.png) [@lissaware](https://community.graylog.org/u/lissaware)\
**Post date:** [September 7, 2018, 7:45pm UTC](https://community.graylog.org/t/delete-logs-from-graylog-elasticsearch/6750/1 "2018-09-07T19:45:49Z")

</div>

I’m trying to delete certain logs from graylog/elasticsearch using a curl query string command with no luck. I know I need to use -XDELETE to remove the log I just what to read it first.

curl -GET ‘[http://localhost:9200/graylog\_26/message/\_query](http://localhost:9200/graylog_26/message/_query)’ -d ‘{“query”:{“query\_string”:{“query”:“message:password AND identity:cc\*”:"{}"}}}’

Error:

curl -GET ‘[http://localhost:9200/graylog\_26/message/\_query](http://localhost:9200/graylog_26/message/_query)’ -d ‘{“query”:{“query\_string”:{“query”:“message:password AND identity:cc”:"{}"}}}’ curl -GET ‘[http://localhost:9200/graylog\_26/message/\_query](http://localhost:9200/graylog_26/message/_query)’ -d ‘{“query”:{“query\_string”:{“query”:“message:password AND identity:cc”:"{}"}}}’ {“error”:{“root\_cause”:[{“type”:“illegal\_argument\_exception”,“reason”:“request [/graylog\_26/message/\_query] contains unrecognized parameter: [â��{â��queryâ��:{â��query\_stringâ��:{â��queryâ��:â��message:password]”}],“type”:“illegal\_argument\_exception”,“reason”:“request [/graylog\_26/message/\_query] contains unrecognized parameter: [â��{â��queryâ��:{â��query\_stringâ��:{â��queryâ��:â��message:password]”},“status”:400}

---

<div class="post-metadata">

**Author:** ![derPhlipsi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/derphlipsi/32/38_2.png) [@derPhlipsi](https://community.graylog.org/u/derPhlipsi)\
**Post date:** [September 10, 2018, 5:09am UTC](https://community.graylog.org/t/delete-logs-from-graylog-elasticsearch/6750/2 "2018-09-10T05:09:11Z")

</div>

Heyo @lissaware,

little hint: The easy and fast way to get a correct and working query to elasticsearch is to run a query on the search or a stream in Graylog and then select show query from the _more actions_ dropdown.

But you should not delete Gralog-managed data from Elasticsearch from outside Graylog. If you do, you’ll have to go to _System -\> Indices -\> :The appropriate index-set: -\> Recalculate index ranges_. 🙂

Greetings,  
Philipp

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 24, 2018, 5:09am UTC](https://community.graylog.org/t/delete-logs-from-graylog-elasticsearch/6750/3 "2018-09-24T05:09:11Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.