@DavidTurner, Thanks a lot for your response.
Blockquote
Are you sure it was a new index? It'd make sense if this index already existed and had moved to the warm phase. Check your logs, the creation of a new index is logged by default.
Yes. These indices would have be been existed and deleted after backup. Looks like they were recreated due to older logs.
Blockquote
Were you using the same Filebeat instance for everything? Might be best to use a different one for your historical data.
No. There are multiple filebeats pushing logs into ELK. Only one of the filebeat started pushing older logs but this blocked everything getting into ELK. But we do have same instance of logstash. Is that causing the issue?
Thanks,