Elasticsearch delete_by_query wrong usage

Question

I am using 2 similar ES methods to load and delete documents:

result = es.search(index='users_favourite_documents',
                   doc_type='favourite_document',
                   body={"query": {"match": {'user': user}}})

And:

result = es.delete_by_query(index='users_favourite_documents',
                            doc_type='favourite_document',
                            body={"query": {"match": {'user': user}}})

First one works ok and returns expected records.
Second one throws Exception:

"TransportError(404,'{
\"found\":false,
\"_index\":\"users_favourite_documents\",
\"_type\":\"favourite_document\",
\"_id\":\"_query\", \"_version\":1,
\"_shards\":{\"total\":2,\"successful\":2, \"failed\":0}}')"

What am I doing wrong?

Answer 1

If you're running ES 2.x, you need to make sure that you have installed the delete-by-query plugin first:

In your ES_HOME folder, run this:

bin/plugin install delete-by-query

Then restart ES and your es.delete_by_query(...) call will work.

If you're running ES 1.x, then delete-by-query is part of the core and that should work out of the box.

Answer 2

I'v used version 6.2.0 of the Elastic Stack and the use of the API works for deleting like this:

es.delete_by_query(index="index_name", doc_type='doc_type', body={"query":{"match": {"message": "message_value"}}})

if your value is INT remove the "" in message_value.