Skip to main content

Scoped log deletion

Scoped deletion removes indexed occurrences for a single day or a single source file, then repairs the affected issues so their counts and dates stay accurate. Use it to clear out a noisy import, a bad log day, or one retired source without wiping your whole index.

Pick exactly one scope​

Every deletion targets either a date or a source, never both and never neither:

ScopeValueMatches
DateYYYY-MM-DDEvery occurrence on that day
Sourcenumeric source_idEvery occurrence from that file

Passing both, passing neither, or an invalid date is rejected before anything is touched.

Preview first​

The preview counts exactly what a deletion would remove, without changing anything:

  • occurrences - rows to delete
  • issue_groups - distinct issues touched
  • sources - distinct source files touched

When you scope by source, the preview also returns that source's metadata (path, log type, channel, size, imported time), so you can confirm you have the right file.

Confirm, then delete​

Deletion requires an exact confirmation string. Anything else is refused:

DELETE LOGS

The whole operation runs in a single transaction. If any step fails, everything rolls back and your index is left untouched.

Transactional recount​

Deleting occurrences would otherwise leave issues with stale totals, so each affected issue is repaired in the same transaction:

  1. Matching occurrences are deleted.
  2. For every issue that lost occurrences, its count, first_seen, and last_seen are recomputed from what remains.
  3. If an issue has no occurrences left, it is removed only if it was created by ingestion.

Manually created issues are never deleted, even when emptied - see Manual issues. Surviving issues keep their correct counts and date range.

What is preserved​

Scoped deletion only affects the index. It never touches:

  • Raw log files - the original files on disk are left in place.
  • Ingestion checkpoints - byte offsets are preserved, so a normal incremental ingest will not re-add what you deleted.

Because the raw files survive, a scoped deletion can still be undone with a full reindex: reindexing resets every source's offset and reprocesses from the start, so the same occurrences come back.