Purge logs according to timestamp

I am trying to wipe some logs from one of my graylog indices using curl. When I execute get I get all my logs, but when trying to delete them I get “found”:false
Here’s my get:

curl -XGET "http://graylog.example.com:9200/graylog_index/message/_search" -d '
{
  "query" : {
    "range" : {
        "timestamp" : { "gte" : "2017-07-27 00:00:00.000", "lt" : "2017-07-29 00:00:00.000||+1M"}
    }
  }
}'

and it is working, but substituting -XGET with -XDELETE and _search with query is returning the following:

{"found":false,"_index":"graylog_index","_type":"message","_id":"_query","_version":1,"_shards":{"total":1,"successful":1,"failed":0}}

Thanks in advance.

You need to install the Delete by Query plugin if you want to delete documents from Elasticsearch defined by a query.

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.