Restoring Elasticsearch Backup
Restoring backups is a crucial aspect of disaster recovery and data management. Restoring a snapshot recovers the data from a previously created snapshot. You can restore a snapshot to the same cluster or a different cluster, depending on your requirements.
To restore a snapshot:
1. Stop the Index Lifecycle Management (ILM) service.
Run the following command to stop the ILM service:
curl -s -X POST "{es_endpoint}/_ilm/stop"
Replace {es_endpoint} with the actual Elasticsearch endpoint URL.
2. Run the pre-restoration tasks.
Run the following command to update a transient cluster-level setting in Elasticsearch to disable name confirmation for destructive actions:
curl -s -X PUT "{es_endpoint}/_cluster/settings" -H 'Content-Type: application/json' -d '{
"transient": {
"action.destructive_requires_name": "false"
}
}'
The action.destructive_requires_name setting controls whether destructive actions, such as index deletion, require a name confirmation. Set it to false to enable name confirmation for destructive actions.
3. Close the indices.
Run the following command to close all indices in an Elasticsearch cluster:
curl -s -X POST "{es_endpoint}/*/_close"
Replace {es_endpoint} with the actual Elasticsearch endpoint URL.
4. Restore the latest snapshot.
Run the following command to restore a snapshot of indices in an Elasticsearch cluster:
curl -s -X POST "{es_endpoint}/_snapshot/{repo_name}/{snapshot_to_restore}/_restore?wait_for_completion=true" -H 'Content-Type: application/json'
-d "{
"indices": "index1,index2"
}"
Replace {es_endpoint} with the actual Elasticsearch endpoint URL, {repo_name} with the snapshot repository name, and {snapshot_to_restore} with the snapshot name you want to restore.
"indices" specifies a comma-separated list of the indices you want to restore from the snapshot.
5. Open the indices.
Run the following command to open all indices that were previously closed and make them available for searches and operations.
curl -s -X POST "{es_endpoint}/*/_open"
Replace {es_endpoint} with the actual Elasticsearch endpoint URL.
6. Run the post-restoration tasks.
Run the following command to update a transient cluster-level setting in Elasticsearch to enable name confirmation for destructive actions:
curl -s -X PUT "{es_endpoint}/_cluster/settings" -H 'Content-Type: application/json' -d '{
"transient": {
"action.destructive_requires_name": "true"
}
}'
The action.destructive_requires_name setting controls whether destructive actions, such as index deletion, require a name confirmation. Set it to true to enable name confirmation for destructive actions.
7. Start the ILM service.
Run the following command to start the ILM service:
curl -s -X POST "{es_endpoint}/_ilm/start"
Replace {es_endpoint} with the actual Elasticsearch endpoint URL.
The snapshot restoration is complete.