Perform update or delete by query

Perform update or delete by query

It is possible to update or delete the documents but you can only perform these actions on the leader index.

  1. First identify which backing index contains the document you want to update.

    1. resp = client.search(
    2.     index="logs-generic-default*",
    3.     filter_path="hits.hits._index",
    4.     query={
    5.         "match": {
    6.             "event.sequence": "97"
    7.         }
    8.     },
    9. )
    10. print(resp)
    1. response = client.search(
    2.   index: 'logs-generic-default*',
    3.   filter_path: 'hits.hits._index',
    4.   body: {
    5.     query: {
    6.       match: {
    7.         'event.sequence' => '97'
    8.       }
    9.     }
    10.   }
    11. )
    12. puts response
    1. const response = await client.search({
    2.   index: "logs-generic-default*",
    3.   filter_path: "hits.hits._index",
    4.   query: {
    5.     match: {
    6.       "event.sequence": "97",
    7.     },
    8.   },
    9. });
    10. console.log(response);
    1. ### On either of the cluster ###
    2. GET logs-generic-default*/_search?filter_path=hits.hits._index
    3. {
    4. "query": {
    5.     "match": {
    6.       "event.sequence": "97"
    7.     }
    8.   }
    9. }
    • If the hits returns "_index": ".ds-logs-generic-default-replicated_from_clustera-<yyyy.MM.dd>-*", then you need to proceed to the next step on cluster A.
    • If the hits returns "_index": ".ds-logs-generic-default-replicated_from_clusterb-<yyyy.MM.dd>-*", then you need to proceed to the next step on cluster B.
    • If the hits returns "_index": ".ds-logs-generic-default-<yyyy.MM.dd>-*", then you need to proceed to the next step on the same cluster where you performed the search query.

  2. Perform the update (or delete) by query:

    1. resp = client.update_by_query(
    2.     index="logs-generic-default",
    3.     query={
    4.         "match": {
    5.             "event.sequence": "97"
    6.         }
    7.     },
    8.     script={
    9.         "source": "ctx._source.event.original = params.new_event",
    10.         "lang": "painless",
    11.         "params": {
    12.             "new_event": "FOOBAR"
    13.         }
    14.     },
    15. )
    16. print(resp)
    1. response = client.update_by_query(
    2.   index: 'logs-generic-default',
    3.   body: {
    4.     query: {
    5.       match: {
    6.         'event.sequence' => '97'
    7.       }
    8.     },
    9.     script: {
    10.       source: 'ctx._source.event.original = params.new_event',
    11.       lang: 'painless',
    12.       params: {
    13.         new_event: 'FOOBAR'
    14.       }
    15.     }
    16.   }
    17. )
    18. puts response
    1. const response = await client.updateByQuery({
    2.   index: "logs-generic-default",
    3.   query: {
    4.     match: {
    5.       "event.sequence": "97",
    6.     },
    7.   },
    8.   script: {
    9.     source: "ctx._source.event.original = params.new_event",
    10.     lang: "painless",
    11.     params: {
    12.       new_event: "FOOBAR",
    13.     },
    14.   },
    15. });
    16. console.log(response);
    1. ### On the cluster identified from the previous step ###
    2. POST logs-generic-default/_update_by_query
    3. {
    4.   "query": {
    5.     "match": {
    6.       "event.sequence": "97"
    7.     }
    8.   },
    9.   "script": {
    10.     "source": "ctx._source.event.original = params.new_event",
    11.     "lang": "painless",
    12.     "params": {
    13.       "new_event": "FOOBAR"
    14.     }
    15.   }
    16. }

    If a soft delete is merged away before it can be replicated to a follower the following process will fail due to incomplete history on the leader, see index.soft_deletes.retention_lease.period for more details.