A question on ILM behaviour on restored indices

Elastic Stack Elasticsearch
,
1

Hi,

I have configured ILM policy to store the data for one month. We create indices daily and after they are a month old we put them as a snapshot in a S3 bucket.

Sometimes there is need for older logs. I can easily restore them back.

But how does ILM look at these restored indices? Does it know that they are restored (I restore them back as they are, even the name is same as original) and hence should not be backed up after a month?

If so then it will save me the hassle of removing the index once we are done with the investigations.

Restoring it as a differently named index is not an option since many of our users have searches saved on the index pattern name.

2

Hi,

It will restore the index as it was on the last time it was snapshotted. Meaning this includes the ILM.

This means when you restore it without modifications the next run of ILM (every 10 minutes) will see the index, recognize it as older as 30 days, and remove it.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.