How to remove selected rows from elasticsearch index by query term filter #elasticsearch #admin #query

es_remove_selected_rows.sh

#!/bin/bash

# example of removing by query from elasticsearch
# redirect the output to a file and then use curl to bulk load it to ES:
# es_remove_selected_rows.sh > out.json
# 
# curl --max-time 120000 -XPOST "$es_host:9200/_bulk" --data-binary @out.json
#
# change conditions in the query/term below

[ -z $1 ] && { echo "need arg: index name (eg. logstash-2016.04.16)"; exit 0; }
index=$1

es_host=myeshost

while read id; do  
        id=${id#*:} ; 
        id=${id//\"/} ; 
        id=${id//,/}; 
        id=${id// /};  
        echo '{ "delete" : { "_index" : "'$index'", "_type" : "livelogs", "_id" : "'$id'" } }';
done < <(curl --max-time 3000 -s -XPOST "http://$es_host:9200/'$index'/_search?pretty=1&size=9999999" \
        -d '{"query": {"filtered": 
                {"query": { "match_all": {} },
                "filter": {"bool": {"must": [  
                        {"term" : { "source_path": "/srv/www/log/access.log" }} 
                        ] } } } } }' | grep \"_id\" )