Can snapshots be used to merge data from indices of the same name?

[Peter_Portante]

Hi Folks,

I am wondering if I can use snapshots to "merge" data from a big mistake we made in our deployments.

On a small cluster, without changing the version of Elasticsearch, we:

1. Stopped the entire Elasticsearch cluster
2. Changed the elasticsearch.yml file on each member to mistakenly point to a new physical disk
3. Restarted the cluster

So now we want to go back to the old disks, and merge the new data with the old.

My thought was to:

1. Stop writes
2. Snapshot current (new) indices
3. Switch back to old disks
4. Load snapshot from new into old
5. Re-enable writes

Will that actually work? Since the transition from old to new disks happened on the same day, both versions of the data on old and new have indices of the same name (prefix + YYYY.mm.dd suffix).

I am hoping that a snapshot restore might be able to merge the index names that are named the same.

Thoughts?

Thanks for considering,

-peter

[Christian_Dahlqvist]

You can not merge indices using snapshot and restore, but can rename indices when restoring them. You could therefore rename prefix-YYYY.mm.dd to e.g. prefix-YYYY.mm.dd-1 during the restore, and although you would have two indices covering the same period, they should both match the index pattern.