Ok... so I can't seem to find a complete restore option. However, I've managed to restore the .kibana_1 and .security-6 indices to different indexes and reindex back into the .kibana_1 and .security-6 indexes respectively. The caveat here is that you must set "include_aliases" to false or it will hose your existing instances. I've provided an example of the security index below:
that being said, ES should really have a full restore option available or at least documented for ECE and/or other contexts. Love the product, you're docs are trash. Specifically, the fact that there are different things that apply for ECE vs the traditional model. I've pushed my Fortune 500 company to get Platinum licensing, I hope this wasn't a mistake.