elasticsearch2.4.4多行删除

今天忽然需要删除某个索引下面的某个type下面的所有xxxx字段以lrz开头的数据，查看elasticsearch2.4.4文档，发现只有根据id一个一个删除，类似如下写法：

$ curl -XDELETE ‘http://localhost:9200/twitter/tweet/1’

查看文档，没有满足该类需求的方法，偶然看见文档如下：

Delete By Query Pluginedit The delete-by-query plugin adds support for deleting all of the documents (from one or more indices) which match the specified query. It is a replacement for the problematic delete-by-queryfunctionality which has been removed from Elasticsearch core.

Internally, it uses Scroll and Bulk APIs to delete documents in an efficient and safe manner. It is slower than the old delete-by-query functionality, but fixes the problems with the previous implementation.

To understand more about why we removed delete-by-query from core and about the semantics of the new implementation, see Why Delete-By-Query is a plugin.

**安装插件 sudo bin/plugin install delete-by-query

The plugin must be installed on every node in the cluster, and each node must be restarted after installation.

**卸载插件 sudo bin/plugin remove delete-by-query

The node must be stopped before removing the plugin.

**使用

$ DELETE /twitter/tweet/_query?q=user:kimchy

那么就可以解决我的问题了，我就按照上面的进行了安装插件，并且把es服务进行了重启，执行命令：

CURL -XDELETE 地址/index/type/_query -d '{ "query": { "query_string": { "default_field": "xxxx", "query": "lrz*" } } }'

由于误操作插入了几条无用数据，xxxx该字段的内容为null，在想把这几条删除，找到判断null的查询，也是查询删除即可，查询命令如下：

{ "query": { "bool": { "must_not": { "exists": { "field": "xxxx" } } } } }

这样就比较完美了。