# Is it possible to restore a single backing index for a data stream **URL:** \ **Category:** Elasticsearch\ **Created:** [August 27, 2023, 7:12pm UTC](https://discuss.elastic.co/t/is-it-possible-to-restore-a-single-backing-index-for-a-data-stream/341761 "2023-08-27T19:12:19Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Post date:** [August 27, 2023, 7:12pm UTC](https://discuss.elastic.co/t/is-it-possible-to-restore-a-single-backing-index-for-a-data-stream/341761/1 "2023-08-27T19:12:19Z")
we somehow lost both the a shard and its replica for the head of our datastream . I forced a rollover to get the datastream to accepting data again and removed the empty index (using api). I now want to restore that backing index from a snapshot but restore fails saying that the index still exists. ---
**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\ **Post date:** [August 29, 2023, 2:19pm UTC](https://discuss.elastic.co/t/is-it-possible-to-restore-a-single-backing-index-for-a-data-stream/341761/2 "2023-08-29T14:19:08Z")
Could you post the api call/restore details and the error message? ---
**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Post date:** [August 29, 2023, 6:34pm UTC](https://discuss.elastic.co/t/is-it-possible-to-restore-a-single-backing-index-for-a-data-stream/341761/3 "2023-08-29T18:34:15Z")
I was working from kibana so i don't have the details. Will look at doing it from the api. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 30, 2023, 12:37am UTC](https://discuss.elastic.co/t/is-it-possible-to-restore-a-single-backing-index-for-a-data-stream/341761/4 "2023-08-30T00:37:13Z")
Hi @Russell_Fulton You got me thinnking about this and the answer is Yes! So this is what I did ... I had a data stream Istio Logs My Case I deleted this backing index `.ds-logs-istio.access_logs-default-2023.08.27-000453` Then set it as a "custom" index pattern in the restore UI ![Screenshot 2023-08-29 at 5.03.10 PM](https://us1.discourse-cdn.com/elastic/original/3X/d/2/d23558571e31b522511af4608064fba18038cb1f.png) Then Restored it ![Screenshot 2023-08-29 at 5.03.03 PM](https://us1.discourse-cdn.com/elastic/original/3X/d/0/d0d7a7ef8c9ee1b748866f53987c00486aafc23f.png) At this point the backing index is restored... but I could not see the data in places... BTW it can take a while to restore etc.. etc... @Russell_Fulton **Now here is the secret Sauce**... even though you restored the index you need to add it back to the data stream in my case you need to use the [Modify Data Stream API](https://www.elastic.co/guide/en/elasticsearch/reference/current/modify-data-streams-api.html#modify-data-streams-api) ```auto POST _data_stream/_modify { "actions": [ { "add_backing_index": { "data_stream": "logs-istio.access_logs-default", "index": ".ds-logs-istio.access_logs-default-2023.08.27-000453" } } ] } ``` I did not see a way to do this step via the API. Then it was all beautiful! ---
**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Post date:** [August 30, 2023, 5:03am UTC](https://discuss.elastic.co/t/is-it-possible-to-restore-a-single-backing-index-for-a-data-stream/341761/5 "2023-08-30T05:03:47Z")
Thanks Stephen! I went back and verified what happened when I tried to restore and got an message: ![Screenshot 2023-08-30 at 4.05.08 PM](https://us1.discourse-cdn.com/elastic/original/3X/9/7/97fa25a9bb2ed60ac1ed1d3f7fcd3ddbbe95da24.png) I remember getting that when I first tried and the screwed up index was still there. I then deleted the (empty) index and now when I try to do the restore: ![Screenshot 2023-08-30 at 4.13.39 PM](https://us1.discourse-cdn.com/elastic/original/3X/0/b/0bc4cee5b63edf934a2d35406fd10ca1bc43eb8e.png) This is where I got to before... listing the indexes in the snapshot shows: ![Screenshot 2023-08-30 at 4.15.47 PM](https://us1.discourse-cdn.com/elastic/original/3X/6/9/697612af2e47d83bb56f0d168d61c89b4f2e89bb.png) and I find that the empty index is back. There are some failed shards but this index was not listed as affected. I then went back to a snapshot with no failed shards got the same result. the index created looks like this: ![Screenshot 2023-08-30 at 4.32.52 PM](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4e5c1649b98b7078ce62dd837a508a30ac63e718.png) I am guessing this is created before the restore starts. I went back to the API to see what I could find out about the snapshot but got a 404 when I did a GET on the specific snapshot. I then tried to list the whole repository: ```auto elasticsearch@secesprd02:~$ curl -X GET -u elastic --noproxy \* "https://es2.insec.auckland.ac.nz:9200/_snapshot/daily/*/_status?pretty" -H 'Content-Type: application/json' Enter host password for user 'elastic': { "error" : { "root_cause" : [ { "type" : "snapshot_missing_exception", "reason" : "[daily:*] is missing" } ], "type" : "snapshot_missing_exception", "reason" : "[daily:*] is missing" }, "status" : 404 } ``` Sigh... ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 30, 2023, 5:16am UTC](https://discuss.elastic.co/t/is-it-possible-to-restore-a-single-backing-index-for-a-data-stream/341761/6 "2023-08-30T05:16:21Z")
First, is the index actually there in the snapshot? Are you sure you are not restoring and empty index. I got the same no restored snapshots but it was really working... 2nd Did you wait? it can take a while.... it can look like an empty index for a while The index appears as that for a while especially if it is large I noticed the same things it took several minutes because it is loading/restoring and has not refreshed. Did you run this to see if the index is there `GET _cat/indices/.ds-sec*?v` you can also refresh the index `POST /my-index-000001/_refresh` Not sure what is up with your snapshot you need a good snapshot.. Not sure about the API not sure where you got the `_status` path from I don't see that in the API. And your repository is named `daily`? what happens if you just run `GET _snapshot/*/*` ---
**Author:** ![Russell\_Fulton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/russell_fulton/32/62888_2.png) [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Post date:** [August 31, 2023, 10:05pm UTC](https://discuss.elastic.co/t/is-it-possible-to-restore-a-single-backing-index-for-a-data-stream/341761/7 "2023-08-31T22:05:41Z")
> got the same no restored snapshots but it was really working... Ah! that is so confusing! sigh... Some indication that there is a restoration in progress would be nice : ) Thanks, it turns out that that page does not show anything until at least one snapshot has been fully restored. Added the magic source and now Kibana shows just one days data missing instead of ten. Thanks again @stephenb for your expertise and patience! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 28, 2023, 10:06pm UTC](https://discuss.elastic.co/t/is-it-possible-to-restore-a-single-backing-index-for-a-data-stream/341761/8 "2023-09-28T22:06:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.