I have configured ILM policy to store the data for one month. We create indices daily and after they are a month old we put them as a snapshot in a S3 bucket.
Sometimes there is need for older logs. I can easily restore them back.
But how does ILM look at these restored indices? Does it know that they are restored (I restore them back as they are, even the name is same as original) and hence should not be backed up after a month?
If so then it will save me the hassle of removing the index once we are done with the investigations.
Restoring it as a differently named index is not an option since many of our users have searches saved on the index pattern name.