# Removing unwanted logs from an index

**URL:** <https://community.graylog.org/t/removing-unwanted-logs-from-an-index/26632>\
**Category:** Graylog Central (peer support)\
**Created:** [November 22, 2022, 10:52am UTC](https://community.graylog.org/t/removing-unwanted-logs-from-an-index/26632 "2022-11-22T10:52:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![m\_mlk](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@m\_mlk](https://community.graylog.org/u/m_mlk)\
**Post date:** [November 22, 2022, 10:52am UTC](https://community.graylog.org/t/removing-unwanted-logs-from-an-index/26632/1 "2022-11-22T10:52:56Z")

</div>

**1. Describe your incident:**  
Some sensible information between 2 dates has been logged in GL by mistake and now I need to find and remove it from the corresponding index.

**2. Describe your environment:**

- OS Information: Ubuntu 20.04 LTS

- Package Version: GL 4.3.9 + OpenSearch 1.3.3

- Service logs, configurations, and environment variables:  

**3. What steps have you already taken to try and solve the problem?**

I found this post [Deleting logs from graylog/elasticsearch (a howto)](https://community.graylog.org/t/deleting-logs-from-graylog-elasticsearch-a-howto/2318) but I don’t feel quite confident about its approach.

**4. How can the community help?**

Is it OK if I change the rotation method to:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/b0bd69b53df9d9db5b28662292236b7d07ebf976.png)

…and apply the changes? would that auto-remove everything older than, say, 1 day?

If not, what would be the recommended method to purge those unwanted logs from the index?

TIA!

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [November 22, 2022, 6:32pm UTC](https://community.graylog.org/t/removing-unwanted-logs-from-an-index/26632/2 "2022-11-22T18:32:33Z")

</div>

I had something similar happen that made my data dirty - I wrote up a short post on it [here](https://community.graylog.org/t/remove-matching-data-from-elasticsearch-via-curl/23090) that might help get you started down the road. The short is that I created a curl command that would find messages with a particular `field:data` combination and I deleted it. Shouldn’t be that hard to modify it for a date range.

Assuming that this is enough to magically make it work for you, make sure you post back what your solution was for future searchers!!!

EDIT: The link to the script you posted has at it’s core something similar to my curl command - results may vary per elastic version you are on.

If you don’t mind loosing all the historical data, the cleanest way to do it is as you suggest, shorten the retention to a day and rotate your index manually. That way you can avoid scripts and curl etc…

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [November 23, 2022, 12:44am UTC](https://community.graylog.org/t/removing-unwanted-logs-from-an-index/26632/3 "2022-11-23T00:44:53Z")

</div>

> [@m\_mlk](#):
>
> and apply the changes? would that auto-remove everything older than, say, 1 day?

Short answer is yes.  
After that you can manually rotate the index set.  
I would suggest using @tmacgbay suggestion if you can.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 7, 2022, 12:45am UTC](https://community.graylog.org/t/removing-unwanted-logs-from-an-index/26632/4 "2022-12-07T00:45:40Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.