Elasticsearch 8.5.2 -- Restoring datastreams isn’t working as planned

Elastic Stack Elasticsearch
1

Hello, I encountered an issue during a datastream restore this morning:

What I want to achieve:

  • restore the backuped indices from may 2023 in the same current working datastream ; I would like to avoid interruption of service as the dataflow are bulking continuously into the datastream.

The behaviour I observed:

  • restoring the latest may 2023 snapshot overwrite the current datastream
  • it does not break the data indexation, but redirect the flow not in a july (date of the day) indices BUT in a old 31th of may indices.
  • all indices starting from june until today are still present on the cluster BUT NOT LINKED to the datastream anymore :confused: and therefore not searchable in kibana discover section

How can I fix this situation?

Thanks in advance for your time and help.

kr,

ps: the procedure I followed:

nb: related topcis:

2

In order to fix the no more linked indices, we can use the api:

POST _data_stream/_modify
{
  "actions": [
  
    {
      "add_backing_index": {
        "data_stream": "lyourdsnamehere-default",
        "index": ".ds-logs-yourdsnamehere-2023.06.02-000085"
      }
    }
  ]
}

BUT I still wondering what is the best approach to restore old index of a datastream into the datastream without breaking anything :confused:

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.