如何删除Elasticsearch索引中不包含特定值的文档？含场景示例

Hey there, let's walk through how to solve your Elasticsearch document deletion needs, plus cover the general approach for this kind of task.

To remove all documents where the metric_name field doesn't match either cpu/time or query/time, you can use Elasticsearch's _delete_by_query API. This tool is built specifically for bulk-deleting docs that match a targeted query—perfect for your use case.

Here's the exact request you'll need (replace your_index_name with your actual index name):

POST /your_index_name/_delete_by_query
{
  "query": {
    "bool": {
      "must_not": [
        {
          "terms": {
            "metric_name": ["cpu/time", "query/time"]
          }
        }
      ]
    }
  }
}

Quick breakdown: #

• The bool/must_not clause tells Elasticsearch to target all docs that don't meet the inner query's conditions.
• The terms query checks if metric_name is one of the two specified values. Combined, this selects every document where metric_name is neither cpu/time nor query/time.

Before running the delete, I strongly recommend swapping _delete_by_query with _search to preview the docs that will be removed—this avoids accidental data loss!

Now let's cover generalized approaches for deleting docs where a field doesn't contain specific values, based on different scenarios:

1. Delete docs where a field doesn't equal a single value #

If you need to remove docs where a field isn't exactly one specific value, use bool/must_not paired with a term query:

POST /your_index/_delete_by_query
{
  "query": {
    "bool": {
      "must_not": [
        {
          "term": {
            "your_field": "target_value"
          }
        }
      ]
    }
  }
}

2. Delete docs where a field doesn't match any of multiple values #

This is the generalized version of your original use case. Use the terms query to list all values you want to keep, then must_not to delete everything else:

POST /your_index/_delete_by_query
{
  "query": {
    "bool": {
      "must_not": [
        {
          "terms": {
            "your_field": ["value_1", "value_2", "value_3"]
          }
        }
      ]
    }
  }
}

3. Delete docs where a field doesn't exist at all #

If you want to remove docs that lack a specific field entirely, reverse the exists query:

POST /your_index/_delete_by_query
{
  "query": {
    "bool": {
      "must_not": [
        {
          "exists": {
            "field": "your_field"
          }
        }
      ]
    }
  }
}

Important Notes: #

• Always preview your query with _search first to confirm you're targeting the right documents.
• For large indexes, add wait_for_completion=false to the request URL (e.g., POST /your_index/_delete_by_query?wait_for_completion=false) to run the deletion in the background. You can check progress using the task ID returned in the response.
• Backup your data before running bulk deletions—especially if you're testing this for the first time. Elasticsearch deletions are permanent!

内容的提问来源于stack exchange，提问作者Abhishek Jain