# How to restore .security index from snapshot **URL:** \ **Category:** Elasticsearch\ **Created:** [October 13, 2023, 1:40am UTC](https://discuss.elastic.co/t/how-to-restore-security-index-from-snapshot/344959 "2023-10-13T01:40:52Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![dna01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dna01/32/120361_2.png) [@dna01](https://discuss.elastic.co/u/dna01)\ **Post date:** [October 13, 2023, 1:40am UTC](https://discuss.elastic.co/t/how-to-restore-security-index-from-snapshot/344959/1 "2023-10-13T01:40:52Z")
what is the recommended approach to restore `.security` index from snapshot? the index needs to be closed to be restored, but once it is closed, users cannot login anymore. and the whole database stuck since it cannot login to reopen the index. seems like chicken and egg problem. ---
**Author:** ![PodarcisMuralis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/podarcismuralis/32/122606_2.png) [@PodarcisMuralis](https://discuss.elastic.co/u/PodarcisMuralis)\ **Post date:** [October 16, 2023, 6:32pm UTC](https://discuss.elastic.co/t/how-to-restore-security-index-from-snapshot/344959/2 "2023-10-16T18:32:39Z")
I do not know the restore part but i deleted once accidentally .security index in kibana and all the usernames and paswords were gone. What i did was to generate built-in user passwords using elasticsearch password reset. And I generated one by one starting from users elastic, kibana\_system. Then I restarted every service (logstash, elasticsearch, kibana etc.) Then it worked for me. Luckily it was test stage. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 18, 2023, 6:08am UTC](https://discuss.elastic.co/t/how-to-restore-security-index-from-snapshot/344959/3 "2023-10-18T06:08:31Z")
> [@dna01](#): > > what is the recommended approach to restore `.security` index from snapshot? The recommendation is to use a file realm user. From - [Restore a snapshot | Elasticsearch Guide [8.10] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.10/snapshots-restore-snapshot.html) > If you run Elasticsearch on your own hardware, [create a superuser in the file realm](https://www.elastic.co/guide/en/elasticsearch/reference/8.10/snapshots-restore-snapshot.html#restore-create-file-realm-user) to ensure you’ll still be able to access your cluster. ---
**Author:** ![dna01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dna01/32/120361_2.png) [@dna01](https://discuss.elastic.co/u/dna01)\ **Post date:** [October 19, 2023, 1:05am UTC](https://discuss.elastic.co/t/how-to-restore-security-index-from-snapshot/344959/4 "2023-10-19T01:05:54Z")
thanks for reply does it mean: - I need to create a "restore user" in file realm. and this user will not get affected with whatever going on in `.security` index? - use this "restore user" throughout the restore process? since my ES is deployed in docker, which file/folder is should I volume-map so it survive restarts? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 26, 2023, 8:17am UTC](https://discuss.elastic.co/t/how-to-restore-security-index-from-snapshot/344959/5 "2023-10-26T08:17:30Z")
> [@dna01](#): > > - I need to create a "restore user" in file realm. and this user will not get affected with whatever going on in `.security` index? > - use this "restore user" throughout the restore process? Yes, to both points. > [@dna01](#): > > since my ES is deployed in docker, which file/folder is should I volume-map so it survive restarts? That sounds like an unrelated question about running ES in docker? Is there a connection to the `.security` index? ---
**Author:** ![dna01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dna01/32/120361_2.png) [@dna01](https://discuss.elastic.co/u/dna01)\ **Post date:** [October 27, 2023, 2:11am UTC](https://discuss.elastic.co/t/how-to-restore-security-index-from-snapshot/344959/6 "2023-10-27T02:11:32Z")
> [@dna01](#): > > since my ES is deployed in docker, which file/folder is should I volume-map so it survive restarts? my question above is related to the file realm authentication. I assume that this information (username, password, roles, etc.) is stored in filesystem somewhere, hence I would need to volume-map that file/folder. more straight forward question would be "where does file realm authentication stores its data?" ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 29, 2023, 11:06am UTC](https://discuss.elastic.co/t/how-to-restore-security-index-from-snapshot/344959/7 "2023-10-29T11:06:56Z")
Thanks for the clarification. The file realm stores its data in the config directory. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 26, 2023, 11:07am UTC](https://discuss.elastic.co/t/how-to-restore-security-index-from-snapshot/344959/8 "2023-11-26T11:07:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.