Drop some field when we restore

Elastic Stack Elasticsearch
1

Hi Team,

Is it possible to remove some fields while restoring indices from snapshots?

Ex: let's assume the doc in the index and take the snapshot

{
    "foo": "bar",
    "bar": "foo"
}

Here would like to remove the field foo and index rest of the field while restoring.

{
    "bar": "foo"
}

we have to remove some sensitive fields when we restore the production into dev.

Regards
Kannan P

2

It's not possible.

You need to reindex for that.

You can use the reindex API to read from an index, write the content to another index and apply an ingest pipeline which will remove the field you don't need anymore.

If you have a commercial license, you can do the read part from a snapshot, without needing to restore it, using searchable snapshots. See Searchable snapshots | Elasticsearch Guide [7.16] | Elastic

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.