Delete Data

Remove documents from Infino datasets.

Delete by Query API

Infino supports deleting multiple documents that match specific criteria using query-based deletion.

Endpoint

PATCH /{dataset}

Request Format

Delete by query operations accept query criteria in multiple formats:

1. JSON Query DSL (in request body)
2. URL Query Parameters
3. Combination of both

Query Parameters

Parameter	Type	Description	Required
start_time	String	Start time for time-based filtering (RFC3339 format)	No
end_time	String	End time for time-based filtering (RFC3339 format)	No

Time Range Filtering

• start_time: RFC3339 formatted timestamp (e.g., 2024-01-15T10:00:00Z)
• end_time: RFC3339 formatted timestamp (defaults to current time if not specified)
• Default range: If no time parameters provided, operates on all documents

Request Body

The request body can contain Query DSL JSON for complex filtering:

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "status": "error"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2024-01-15T00:00:00Z",
              "lte": "2024-01-15T23:59:59Z"
            }
          }
        }
      ]
    }
  }
}

Examples

Simple Query String Deletion

PATCH /{dataset}?q=status:error

Authentication: This request must be authenticated using one of the methods described in the Authentication documentation.

Time Range Deletion

PATCH /{dataset}

{
  "start_time": "2024-01-01T00:00:00Z",
  "end_time": "2024-01-15T00:00:00Z"
}

Authentication: This request must be authenticated using one of the methods described in the Authentication documentation.

Complex Query DSL Deletion

PATCH /{dataset}

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "level": "debug"
          }
        },
        {
          "range": {
            "@timestamp": {
              "lt": "2024-01-01T00:00:00Z"
            }
          }
        }
      ]
    }
  }
}

Authentication: This request must be authenticated using one of the methods described in the Authentication documentation.

Combined Parameters and Body

PATCH /{dataset}?start_time=2024-01-15T00:00:00Z&end_time=2024-01-15T23:59:59Z

{
  "query": {
    "match": {
      "status": "temporary"
    }
  }
}

Authentication: This request must be authenticated using one of the methods described in the Authentication documentation.

Response Format

Successful deletion returns the count of deleted documents:

{
  "deleted": 1250
}

Response Fields

• deleted: Number of documents that were successfully deleted

Error Responses

400 Bad Request

Invalid query syntax or parameters:

{
  "status": "error",
  "message": "Delete logs by query error: Invalid query syntax"
}

404 Not Found

Dataset does not exist:

{
  "status": "error", 
  "message": "Delete logs by query error: Dataset not found"
}

500 Internal Server Error

Server-side processing errors:

{
  "status": "error",
  "message": "Delete logs by query error: Processing failed"
}

Best Practices

Safety and Verification

• Test queries first: Use the search API with the same query to verify which documents will be deleted
• Use time ranges: Limit deletion scope with start_time and end_time parameters
• Backup critical data: Always backup important data before bulk deletion operations
• Small batches: For large deletions, consider breaking into smaller time-based chunks

Performance Optimization

• Dataset specific: Always specify the exact dataset name rather than using wildcards
• Time-based filtering: Use timestamp ranges to improve deletion performance
• Simple queries: Use simple query strings when possible for better performance

Query Construction

• Match patterns: Use specific field matches rather than broad text searches
• Range queries: Leverage timestamp and numeric ranges for efficient filtering
• Boolean logic: Combine conditions with bool queries for precise targeting
• Field existence: Use exists queries to target documents with specific fields

Data Loss Warning

Delete by query operations permanently remove data and cannot be undone. Always verify your query criteria before execution.