What are update_by_query and delete_by_query in Elasticsearch?

Answer

update_by_query (POST /index/_update_by_query) finds all documents matching a query and updates them using a Painless script, without retrieving them to the application first. For example, add a field to all documents where status: "active". delete_by_query (POST /index/_delete_by_query) finds all documents matching a query and deletes them in bulk. Both operations use a snapshot of the index state at the time of the request and process documents in batches. They can be throttled to reduce cluster load using the requests_per_second parameter. For large datasets, they can take a long time and should be run asynchronously using the wait_for_completion=false parameter.