Is it possible to restore a single backing index for a data stream

Elastic Stack Elasticsearch
4

Hi @Russell_Fulton You got me thinnking about this and the answer is Yes!

So this is what I did ... I had a data stream Istio Logs

My Case I deleted this backing index
.ds-logs-istio.access_logs-default-2023.08.27-000453

Then set it as a "custom" index pattern in the restore UI

Screenshot 2023-08-29 at 5.03.10 PM
Screenshot 2023-08-29 at 5.03.10 PM2658×460 66.9 KB

Then Restored it

Screenshot 2023-08-29 at 5.03.03 PM
Screenshot 2023-08-29 at 5.03.03 PM2792×1544 259 KB

At this point the backing index is restored... but I could not see the data in places...
BTW it can take a while to restore etc.. etc...

@Russell_Fulton Now here is the secret Sauce ... even though you restored the index you need to add it back to the data stream in my case you need to use the Modify Data Stream API

POST _data_stream/_modify
{
  "actions": [
    {
      "add_backing_index": {
        "data_stream": "logs-istio.access_logs-default",
        "index": ".ds-logs-istio.access_logs-default-2023.08.27-000453"
      }
    }
  ]
}

I did not see a way to do this step via the API.
Then it was all beautiful!

2 Likes