Daily Snapshot script question

Elastic Stack Elasticsearch
1

I have a snapshot repository in which I would like to have backups of my daily indices. I wanted to automate this process by creating a snapshot of the previous day's index daily.

My script thus far is:

yesterday="$(date -d "yesterday 13:00" '+%Y.%m.%d')"
curl -XPUT "http://localhost:9200/_snapshot/test_backup/$yesterday" -d '{
   "indices": "sflow-$yesterday",
   "ignore_unavailable": true,
   "include_global_state": false
}'

I guess this is more of a syntax question but when I run this, it creates a snapshot of no indices.

when I run this: curl -XGET "http://localhost:9200/_snapshot/test_backup/$yesterday?pretty",
I get this output:

{
"snapshots" : [
{
  "snapshot" : "2017.11.21",
  "uuid" : "am11Fd1hSauT5xzcnk215A",
  "version_id" : 5050199,
  "version" : "5.5.1",
  "indices" : [ ],
  "state" : "SUCCESS",
  "start_time" : "2017-11-22T16:43:44.353Z",
  "start_time_in_millis" : 1511369024353,
  "end_time" : "2017-11-22T16:43:44.357Z",
  "end_time_in_millis" : 1511369024357,
  "duration_in_millis" : 4,
  "failures" : [ ],
  "shards" : {
    "total" : 0,
    "failed" : 0,
    "successful" : 0
  }
}
]
}

You'll see that indices is []. When instead of using "indices": "sflow-$yesterday", I use "indices": "sflow-{actual date}", it works and starts the snapshot.

Why is that?

2

I ended up using the python elasticsearch client to accomplish this instead of using bash.

3

When you take a full snapshot, doesnt elasticsearch take a snapshot and automatically know what indicies you have backed in the same repo, and therefore only backes up the changed/new data?

I have created a powershell function that i use, you can steal the api call from that:

4

Why not Elasticsearch Curator?