Deleting documents in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the basic way to delete a document in Elasticsearch?

You delete a document by specifying its index and ID using the DELETE API, like:
DELETE /index_name/_doc/document_id

beginner

What happens if you try to delete a document that does not exist?

Elasticsearch returns a successful response with result: "not_found", meaning the document was not found but no error occurs.

intermediate

How can you delete multiple documents matching a query?

Use the _delete_by_query API with a query to delete all documents matching that query in an index.

intermediate

What is the difference between DELETE /index/_doc/id and POST /index/_delete_by_query?

DELETE /index/_doc/id deletes a single document by ID.
_delete_by_query deletes all documents matching a query, potentially many at once.

intermediate

Why should you be careful when using _delete_by_query?

Because it can delete many documents at once, possibly more than intended, so always test your query carefully before running it.

Which HTTP method is used to delete a single document by ID in Elasticsearch?

A GET

B POST

C DELETE

D PUT

The DELETE method is used to remove a document by its ID.

What does Elasticsearch return if you delete a document that does not exist?

A result: 'not_found'

B An error

C result: 'deleted'

D No response

Elasticsearch returns a successful response with result 'not_found' if the document is missing.

Which API allows deleting multiple documents matching a query?

A _delete_all

B _bulk_delete

C _delete_by_id

D _delete_by_query

The _delete_by_query API deletes all documents matching a query.

What is a key risk when using _delete_by_query?

A It can delete more documents than intended

B It cannot delete documents

C It requires no query

D It deletes only one document

If the query is too broad, _delete_by_query can delete many documents unintentionally.

How do you specify the document to delete in the DELETE API?

A By query only

B By index and document ID

C By document content

D By document size

You specify the index and the document ID to delete a single document.

Explain how to delete a single document in Elasticsearch and what happens if the document does not exist.

Think about the HTTP method and response.

Describe the _delete_by_query API and why you should use it carefully.

Consider bulk deletion and query safety.

Practice

1.

Which Elasticsearch API method is used to delete a single document by its ID?

easy

A. GET method with document ID

B. DELETE method with document ID

C. POST method with document ID

D. PUT method with document ID

Solution

1. Step 1: Understand document deletion in Elasticsearch

   Deleting a single document requires specifying its ID and using the DELETE HTTP method.

2. Step 2: Identify the correct API method

   The DELETE method with the document ID is the standard way to remove one document.

3. Final Answer:

   DELETE method with document ID -> Option B

4. Quick Check:

   Delete single document = DELETE with ID [OK]

Hint: Use DELETE with document ID to remove one document fast [OK]

Common Mistakes:

• Using GET or POST instead of DELETE
• Trying to delete without specifying document ID
• Confusing _delete_by_query with single document deletion

2.

Which of the following is the correct syntax to delete a document with ID 123 from index products using Elasticsearch REST API?

?

easy

A. GET /products/_delete/123

B. POST /products/_doc/123/_delete

C. DELETE /products/_doc/123

D. PUT /products/_doc/123

Solution

1. Step 1: Recall the REST API syntax for deleting a document

   The correct syntax uses DELETE method on the path /index/_doc/document_id.

2. Step 2: Match the syntax with the options

   DELETE /products/_doc/123 matches DELETE /products/_doc/123 which is correct.

3. Final Answer:

   DELETE /products/_doc/123 -> Option C

4. Quick Check:

   Delete syntax = DELETE /index/_doc/id [OK]

Hint: DELETE + /index/_doc/document_id is the right syntax [OK]

Common Mistakes:

• Using POST or GET instead of DELETE
• Wrong URL path like _delete or missing _doc
• Using PUT which is for creating/updating

3.

Given this Elasticsearch _delete_by_query request to delete documents where status is "inactive":

{
  "query": {
    "term": { "status": "inactive" }
  }
}

What will be the result if there are 3 documents matching this query?

medium

A. Deletes 3 documents and returns success count 3

B. Deletes 0 documents because term query is incorrect

C. Deletes all documents in the index

D. Returns an error due to missing document ID

Solution

1. Step 1: Understand _delete_by_query behavior

   It deletes all documents matching the query, here documents with status "inactive".

2. Step 2: Apply to given query and data

   Since 3 documents match, all 3 will be deleted and success count will be 3.

3. Final Answer:

   Deletes 3 documents and returns success count 3 -> Option A

4. Quick Check:

   _delete_by_query deletes matching docs = 3 [OK]

Hint: Delete by query removes all matching docs, not just one [OK]

Common Mistakes:

• Thinking _delete_by_query needs document ID
• Assuming it deletes all documents regardless of query
• Confusing term query syntax

4.

What is wrong with this Elasticsearch delete request?

DELETE /users/_doc

It aims to delete a document but fails. Why?

medium

A. Missing document ID in the URL

B. Using DELETE instead of POST

C. Index name is incorrect

D. Missing request body with query

Solution

1. Step 1: Check the delete request URL format

   Deleting a document requires the document ID after _doc in the URL.

2. Step 2: Identify the missing part

   The request lacks the document ID, so Elasticsearch cannot identify which document to delete.

3. Final Answer:

   Missing document ID in the URL -> Option A

4. Quick Check:

   Delete URL needs document ID [OK]

Hint: Always include document ID after _doc in DELETE URL [OK]

Common Mistakes:

• Omitting document ID in delete URL
• Confusing DELETE with POST for deletion
• Thinking request body is needed for single delete

5.

You want to delete all documents from the orders index where the amount field is less than 100. Which Elasticsearch request correctly achieves this?

hard

A. DELETE /orders/_delete_by_query { "query": { "term": { "amount": 100 } } }

B. DELETE /orders/_doc { "query": { "range": { "amount": { "lt": 100 } } } }

C. POST /orders/_doc/amount_lt_100/_delete

D. POST /orders/_delete_by_query { "query": { "range": { "amount": { "lt": 100 } } } }

Solution

1. Step 1: Identify the correct API for deleting multiple documents by condition

   _delete_by_query is used with POST to delete documents matching a query.

2. Step 2: Check the query for amount less than 100

   The range query with "lt": 100 correctly matches documents with amount less than 100.

3. Step 3: Verify the request method and path

   POST /orders/_delete_by_query with the correct JSON body is the proper syntax.

4. Final Answer:

   POST /orders/_delete_by_query { "query": { "range": { "amount": { "lt": 100 } } } } -> Option D

5. Quick Check:

   Delete by query with range and POST = correct [OK]

Hint: Use POST _delete_by_query with range query for conditional deletes [OK]

Common Mistakes:

• Using DELETE method with request body (not supported)
• Using _doc endpoint instead of _delete_by_query
• Using term query instead of range for less than condition