Delete Events API

Delete Events is a BETA feature. Requires Humio version 1.5.0+

Humio has support for deleting individual events from the compressed segment files.

This API is not intended to support data management or bulk deletion. Using it for these purposes is extremely inefficient. If you want to bulk delete data, you may want to adjust retention settings, or use the GraphQL API to delete the relevant dataspaces or datasources.

This API is intended to support removal of a small number of events from Humio, allowing you to eliminate specific events that must be removed for some reason. Common cases where this is useful is if you need to remove some personally identifiable information (e.g., due to a GDPR request), accidentally logged passwords or other confidential data from Humio.

The delete mechanism will initially exclude the events you mark for deletion from future queries by filtering all query results. Once Humio determines that it is safe to do so, it will rewrite the affected segments, excluding the events that were marked for deletion. As rewriting segments is an expensive operation, we strongly discourage using this API in cases for which appropriate retention settings, or explicit deletions of dataspaces, would suffice.

You must be authorized to execute “delete events”.

This is an example using the REST API deleting all events with a password field in the specified time interval in milliseconds.

shell
curl -v https://$YOUR_HUMIO_URL/api/v1/repositories/$REPOSITORY_NAME/deleteevents \
  -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"queryString": "password=*", "startTime": 1551074900671, "endTime": 1551123730700}'

The endpoint will return HTTP status code 201 (Created) if the delete was scheduled. The entity returned is a short string being the internal ID of the delete. You may use this if tracking the execution of the delete in some other system.

The REST endpoint displayed above is deprecated starting with version 1.27 of Humio. Users are encouraged to use instead the corresponding GraphQL mutation described below.

The GraphQL mutation deleteEvents, can be used to submit deletions.

The GraphQL query deleteEvents will return the list of pending deletes being processed in the background.

An example listing the pending deletes in the Humio repository, using the GraphQL API Explorer.

humio
query {
  deleteEvents(repositoryName: "humio") {
    id
  }
}

It is possible to cancel submitted deletions via the cancelDeleteEvents mutation.

Cancellation is best-effort, and if events have already been deleted from segments, they will not be restored.

Related KB Articles