# Closing all indices before system recovery

**URL:** <https://discuss.elastic.co/t/closing-all-indices-before-system-recovery/287163>\
**Category:** Kibana\
**Tags:** snapshot-and-restore\
**Created:** [October 20, 2021, 8:06am UTC](https://discuss.elastic.co/t/closing-all-indices-before-system-recovery/287163 "2021-10-20T08:06:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Waxman](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@Waxman](https://discuss.elastic.co/u/Waxman)\
**Post date:** [October 20, 2021, 8:06am UTC](https://discuss.elastic.co/t/closing-all-indices-before-system-recovery/287163/1 "2021-10-20T08:06:09Z")

</div>

Hi All,

I'd like to ask if there is a possibility to recover whole cluster without closing indices ?  
In Kibana 7.11.2-\> stack management -\> snapshot and restore -\>when trying restore "All data streams and indices, including system indices"  
-\> i'm getting:

`  
Unable to restore snapshot

[snapshot\_restore\_exception] [es\_backup:daily-snap-2021.10.20-xaq5a3leraymvisnlfttoa/n35AFb6bQOqNykET32yZAg] cannot restore index [.ds-ilm-history-5-2021.10.12-000001] because an open index with same name already exists in the cluster. Either close or delete the existing index or restore the index under a different name by providing a rename pattern and replacement name.  
`

Is there a chance to close all indices without losing the system ? Because when I close all indices (not one by one because it's taking too long) I need an emergency user to operate cluster. Is there any other way to restore whole cluster ?

---

<div class="post-metadata">

**Author:** ![Waxman](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@Waxman](https://discuss.elastic.co/u/Waxman)\
**Post date:** [October 22, 2021, 10:19am UTC](https://discuss.elastic.co/t/closing-all-indices-before-system-recovery/287163/2 "2021-10-22T10:19:18Z")

</div>

Look like the restore cannot be done when some data streams are open. Is there a way to use the snapshot from GUI or curl with open data stream ? Another thing is we cannot delete/close the data stream. Looks like some circle problem 🙂

---

<div class="post-metadata">

**Author:** ![Waxman](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@Waxman](https://discuss.elastic.co/u/Waxman)\
**Post date:** [October 26, 2021, 9:32am UTC](https://discuss.elastic.co/t/closing-all-indices-before-system-recovery/287163/3 "2021-10-26T09:32:17Z")

</div>

I did some googling and find two options:  
xpack.ilm.enabled: false  
indices.lifecycle.history\_index\_enabled: false  
Setting those parameters probably helped.

---

<div class="post-metadata">

**Author:** ![sebastien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastien/32/36119_2.png) [@sebastien](https://discuss.elastic.co/u/sebastien)\
**Post date:** [October 27, 2021, 9:42am UTC](https://discuss.elastic.co/t/closing-all-indices-before-system-recovery/287163/4 "2021-10-27T09:42:03Z")

</div>

Hi @Waxman

The `.ds-ilm-history-5-2021.10.12-000001` is indeed the lifecycle history index. Were you able to create a snapshot after setting `indices.lifecycle.history_index_enabled: false` ?

Thanks  
Sébastien

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 24, 2021, 9:42am UTC](https://discuss.elastic.co/t/closing-all-indices-before-system-recovery/287163/5 "2021-11-24T09:42:22Z")

</div>

Closed on November 24, 2021, 9:42am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.