The delete-by-query plugin adds support for deleting all of the documents (from one or more indices) which match the specified query. It is a replacement for the problematic delete-by-query functionality which has been removed from Elasticsearch core.
Internally, it uses the Scan/Scroll and Bulk APIs to delete documents in an efficient and safe manner. It is slower than the old delete-by-query functionality, but fixes the problems with the previous implementation.
To understand more about why we removed delete-by-query from core and about the semantics of the new implementation, see Why Delete-By-Query is a plugin.
Queries which match large numbers of documents may run for a long time, as every document has to be deleted individually. Don’t use delete-by-query to clean out all or most documents in an index. Rather create a new index and perhaps reindex the documents you want to keep.
This plugin can be installed using the plugin manager:
sudo bin/plugin install delete-by-query
The plugin must be installed on every node in the cluster, and each node must be restarted after installation.
The plugin can be removed with the following command:
sudo bin/plugin remove delete-by-query
The node must be stopped before removing the plugin.