# Accidentally deleted all indices from the cluster. How do I restore the data? **URL:** \ **Category:** Elasticsearch\ **Created:** [September 17, 2018, 9:51am UTC](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806 "2018-09-17T09:51:52Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![rshetty](https://avatars.discourse-cdn.com/v4/letter/r/6a8cbe/32.png) [@rshetty](https://discuss.elastic.co/u/rshetty)\ **Post date:** [September 17, 2018, 9:51am UTC](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806/1 "2018-09-17T09:51:52Z")
Hi, I know we messed up big time by accidentally deleting all the indices from the cluster but I needed input regarding what is the proper procedure to restore it back. While running the curator tool, accidentally gave the wrong action file thus resulting in all the indices being deleted from the cluster. This cluster had all x-pack settings configured, ssl settings configured, ldap and so on. The issue now is that, though I do have a snapshot of the recent data present in one of the folders of the server (This path is not registered as a repository yet, though it contains the snapshot), the issue is in starting elasticsearch service again because the **.security** index has also been deleted thus we get an x-pack exception. I have stopped the ES, kibana and logstash services for now. I just want to know the right sequence of restoring the data from the snapshot I have, I have not restored a snapshot manually before so It would be really helpful if someone could just guide me regarding this. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 17, 2018, 9:56am UTC](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806/2 "2018-09-17T09:56:21Z")
The best option would be to setup a file realm and then use that to auth and restore from there. ---
**Author:** ![rshetty](https://avatars.discourse-cdn.com/v4/letter/r/6a8cbe/32.png) [@rshetty](https://discuss.elastic.co/u/rshetty)\ **Post date:** [September 17, 2018, 10:06am UTC](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806/3 "2018-09-17T10:06:34Z")
@warkolm Will I be able to restore the elastic credentials without having to re-do the entire x-pack password set up? Because I really need to restore the .security index with the recent elastic credentials rather than setting new password for it. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 17, 2018, 10:08am UTC](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806/4 "2018-09-17T10:08:11Z")
Once you restore you should be ok to use those details. But you will need to run through the setup for file realm to get you access back to Elasticsearch. ---
**Author:** ![rshetty](https://avatars.discourse-cdn.com/v4/letter/r/6a8cbe/32.png) [@rshetty](https://discuss.elastic.co/u/rshetty)\ **Post date:** [September 17, 2018, 10:32am UTC](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806/5 "2018-09-17T10:32:48Z")
@warkolm I configured the file realm, used the users command to add a new user with superuser role and also commented the ldap realm in my yaml just in case. But even if I try to start elasticsearch services after the file realm changes in place, it still gives the error: [2018-09-17T12:30:10,755][INFO][o.e.x.s.a.AuthenticationService] [] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic] I followed these steps to configure the realm: [https://www.elastic.co/guide/en/elasticsearch/reference/master/configuring-file-realm.html](https://www.elastic.co/guide/en/elasticsearch/reference/master/configuring-file-realm.html) ---
**Author:** ![rshetty](https://avatars.discourse-cdn.com/v4/letter/r/6a8cbe/32.png) [@rshetty](https://discuss.elastic.co/u/rshetty)\ **Post date:** [September 17, 2018, 11:04am UTC](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806/6 "2018-09-17T11:04:51Z")
I figured out the issue. I had to disable all the xpack settings and ssl settings as monitoring, watcher, etc seem to be using the elastic credential. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [September 18, 2018, 4:12am UTC](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806/7 "2018-09-18T04:12:32Z")
> [@rshetty](#): > > I had to disable all the xpack settings and ssl settings as monitoring, watcher, etc seem to be using the elastic credential. This is not correct. I don't know what issue you ran into, but internal services do not use the `elastic` user. > [2018-09-17T12:30:10,755][INFO][o.e.x.s.a.AuthenticationService] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic] This is not an _error_. It is an informational message that the incorrect password was provided for te `elastic` user, but it does not prevent the service from starting. ---
**Author:** ![rshetty](https://avatars.discourse-cdn.com/v4/letter/r/6a8cbe/32.png) [@rshetty](https://discuss.elastic.co/u/rshetty)\ **Post date:** [September 20, 2018, 9:14am UTC](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806/8 "2018-09-20T09:14:33Z")
@TimV I realize that but I had already stopped the services (kibana & logstash) that are connecting to elastic for the elastic user credentials, yet this incorrect password message still persisted. It was difficult to start the services because this message kept appearing every second in the logs so I was not able check what other logs were getting generated after my file realm changes. I needed re-configure the x-pack set up passwords and check if it was getting properly authenticated. But I wasn't able to figure out where this info message kept coming from. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 18, 2018, 9:14am UTC](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806/9 "2018-10-18T09:14:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.