从搜索查询中删除文档

时间:2019-03-06 15:58:33

标签: elasticsearch logstash kibana elastic-stack

我将此请求用于获取索引中重复的所有(200)个文档,并且我希望删除此结果中的所有文档。我尝试使用_delete_by_query进行搜索,但经过多次尝试并在Internet上搜索后,我失败了...

我的查询是:

GET /index-ip/_query
{
  "aggs": {
      "dup": {
         "terms": {
            "size" : 200,
            "field": "ip_commune.keyword",
            "min_doc_count": 2
     }
    }
  }
}

返回结果:

{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 754,
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "index-ip",
        "_type" : "doc",
        "_id" : "V64TV2kB0AORAV2GIdMZ",
        "_score" : 1.0,
        "_source" : {
          "ip_commune" : "98.183.164.36",
          "@version" : "1",
          "tags" : [
            "ip-ipam"
          ],
          "@timestamp" : "2019-03-07T07:34:24.874Z"
        }
      },
      {
        "_index" : "index-ip",
        "_type" : "doc",
        "_id" : "Dq4TV2kB0AORAV2GIdUe",
        "_score" : 1.0,
        "_source" : {
          "ip_commune" : "136.168.48.254",
          "@version" : "1",
          "tags" : [
            "ip-glpi"
          ],
          "@timestamp" : "2019-03-07T07:34:24.979Z"
        }
      },
      {
        "_index" : "index-ip",
        "_type" : "doc",
        "_id" : "264TV2kB0AORAV2GIdUf",
        "_score" : 1.0,
        "_source" : {
          "ip_commune" : "137.83.124.226",
          "@version" : "1",
          "tags" : [
            "ip-glpi"
          ],
          "@timestamp" : "2019-03-07T07:34:24.889Z"
        }
      },
      {
        "_index" : "index-ip",
        "_type" : "doc",
        "_id" : "F64TV2kB0AORAV2GIdUe",
        "_score" : 1.0,
        "_source" : {
          "ip_commune" : "136.168.50.1",
          "@version" : "1",
          "tags" : [
            "ip-glpi"
          ],
          "@timestamp" : "2019-03-07T07:34:24.980Z"
        }
      },
      {
        "_index" : "index-ip",
        "_type" : "doc",
        "_id" : "Iq4TV2kB0AORAV2GIdUe",
        "_score" : 1.0,
        "_source" : {
          "ip_commune" : "136.168.86.91",
          "@version" : "1",
          "tags" : [
            "ip-glpi"
          ],
          "@timestamp" : "2019-03-07T07:34:25.003Z"
        }
      },
      {
        "_index" : "index-ip",
        "_type" : "doc",
        "_id" : "Za4TV2kB0AORAV2GIdYh",
        "_score" : 1.0,
        "_source" : {
          "ip_commune" : "137.69.223.4",
          "@version" : "1",
          "tags" : [
            "ip-glpi"
          ],
          "@timestamp" : "2019-03-07T07:34:24.888Z"
        }
      },
      {
        "_index" : "index-ip",
        "_type" : "doc",
        "_id" : "Z64TV2kB0AORAV2GIdYh",
        "_score" : 1.0,
        "_source" : {
          "ip_commune" : "137.78.101.254",
          "@version" : "1",
          "tags" : [
            "ip-glpi"
          ],
          "@timestamp" : "2019-03-07T07:34:24.888Z"
        }
      },
      {
        "_index" : "index-ip",
        "_type" : "doc",
        "_id" : "aa4TV2kB0AORAV2GIdYh",
        "_score" : 1.0,
        "_source" : {
          "ip_commune" : "137.83.29.198",
          "@version" : "1",
          "tags" : [
            "ip-glpi"
          ],
          "@timestamp" : "2019-03-07T07:34:24.890Z"
        }
      },
      {
        "_index" : "index-ip",
        "_type" : "doc",
        "_id" : "d64TV2kB0AORAV2GIdYh",
        "_score" : 1.0,
        "_source" : {
          "ip_commune" : "98.183.164.55",
          "@version" : "1",
          "tags" : [
            "ip-glpi"
          ],
          "@timestamp" : "2019-03-07T07:34:24.916Z"
        }
      },
      {
        "_index" : "index-ip",
        "_type" : "doc",
        "_id" : "-a4TV2kB0AORAV2GIdUf",
        "_score" : 1.0,
        "_source" : {
          "ip_commune" : "98.183.164.117",
          "@version" : "1",
          "tags" : [
            "ip-glpi"
          ],
          "@timestamp" : "2019-03-07T07:34:24.899Z"
        }
      }
    ]
  },
  "aggregations" : {
    "dup" : {
      "doc_count_error_upper_bound" : 0,
      "sum_other_doc_count" : 0,
      "buckets" : [
        {
          "key" : "98.183.164.124",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.142",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.166",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.172",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.232",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.25",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.27",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.28",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.29",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.35",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.36",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.37",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.38",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.39",
          "doc_count" : 2
        },
        {
          "key" : "98.183.164.58",
          "doc_count" : 2
        },
        {
          "key" : "98.183.27.21",
          "doc_count" : 2
        },
        {
          "key" : "98.183.27.22",
          "doc_count" : 2
        },
        {
          "key" : "98.183.27.23",
          "doc_count" : 2
        },
        {
          "key" : "98.183.27.24",
          "doc_count" : 2
        },
        {
          "key" : "98.183.27.25",
          "doc_count" : 2
        },
        {
          "key" : "98.183.27.27",
          "doc_count" : 2
        },
        {
          "key" : "98.183.27.28",
          "doc_count" : 2
        }
      ]
    }
  }
}

我不想保留重复的记录之一=)我需要删除两个记录。 我的目标是比较两个ITSM(GLPI)和IPAM IP列表,以提取不在GLPI中的所有IP地址 任何想法 ? :confused:对不起,我的英语不好^^

0 个答案:

没有答案