Is it possible to restore a specific index from a datastream to a datastream from snapshot

Elastic Stack Elasticsearch
,
1

Recently we migrated our elasticsearch cluster and used snapshot/restore to do this.

Unfortunately we forgot about a change we made to the lifecycle policy of a the apm traces datastream. Which meant data older than 90 days were automatically deleted.

I can see in the snapshot that the data indexes exist

.ds-traces-apm.rum-default-2022.08.07-000003
.ds-traces-apm.rum-default-2022.09.06-000004
.ds-traces-apm.rum-default-2022.10.06-000006
.ds-traces-apm.rum-default-2022.11.05-000007
.ds-traces-apm.rum-default-2022.12.05-000009

But when i come to restore just these indexes, i can only select the entire data stream. (should i select the entire data stream?, what will happen to the current index)

image
image1518×739 85.5 KB

Is it possible to restore a specific index to a data stream?

I can't see specific indexes in the drop down, but if i copy and paste the exact name .ds-traces-apm.rum-default-2022.08.07-000003 it will restore. but im left with the problem that the index that i restored is not associated with the data stream?

image
image1630×241 29.1 KB

Is there a way to do this properly?

1 Like
2

We have the same question. We lost both a primary and replica shard from one of our indices and wanted to restore that single index.

3

Any new on "how to link restored index or any index" to a current datastream ?

Following a restore, I've multiple indices that are not associated with the current datastream anymore :confused:

The procedure I followed is this one: Restore a managed data stream or index | Elasticsearch Guide [8.8] | Elastic

4

In order to fix the no more linked indices, we can use the api:

POST _data_stream/_modify
{
  "actions": [
  
    {
      "add_backing_index": {
        "data_stream": "lyourdsnamehere-default",
        "index": ".ds-logs-yourdsnamehere-2023.06.02-000085"
      }
    }
  ]
}
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.