# Issue with restoring .kibana\_1 and .security-6 indices

**URL:** <https://discuss.elastic.co/t/issue-with-restoring-kibana-1-and-security-6-indices/171579>\
**Category:** Elasticsearch\
**Created:** [March 9, 2019, 2:21am UTC](https://discuss.elastic.co/t/issue-with-restoring-kibana-1-and-security-6-indices/171579 "2019-03-09T02:21:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eric\_Moss](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@Eric\_Moss](https://discuss.elastic.co/u/Eric_Moss)\
**Post date:** [March 9, 2019, 2:21am UTC](https://discuss.elastic.co/t/issue-with-restoring-kibana-1-and-security-6-indices/171579/1 "2019-03-09T02:21:34Z")

</div>

After a frustrating day trying to get my head around restoring snapshots from another cluster in ECE/S3 Repo, I've managed to kill my new deployment. I closed the .security-6 index in an attempt to do a full restore and now I'm not sure how to reopen it. This is 6.6.0 installed via ECE.

Eric

---

<div class="post-metadata">

**Author:** ![Eric\_Moss](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@Eric\_Moss](https://discuss.elastic.co/u/Eric_Moss)\
**Post date:** [March 9, 2019, 2:23am UTC](https://discuss.elastic.co/t/issue-with-restoring-kibana-1-and-security-6-indices/171579/2 "2019-03-09T02:23:00Z")

</div>

Here is the error I see in kibana.. I've tried reopening it, but it complains of an auth issue.

[index\_closed\_exception] closed, with { index\_uuid="S-9SupwrTuyeK7Fzy4NXtQ" & index=".security-6" & suppressed={ 0={ type="index\_closed\_exception" & reason="closed" & index\_uuid="S-9SupwrTuyeK7Fzy4NXtQ" & index=".security-6" } & 1={ type="index\_closed\_exception" & reason="closed" & index\_uuid="S-9SupwrTuyeK7Fzy4NXtQ" & index=".security-6" } & 2={ type="index\_closed\_exception" & reason="closed" & index\_uuid="S-9SupwrTuyeK7Fzy4NXtQ" & index=".security-6" } } }

---

<div class="post-metadata">

**Author:** ![Eric\_Moss](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@Eric\_Moss](https://discuss.elastic.co/u/Eric_Moss)\
**Post date:** [March 11, 2019, 4:32pm UTC](https://discuss.elastic.co/t/issue-with-restoring-kibana-1-and-security-6-indices/171579/3 "2019-03-11T16:32:34Z")

</div>

Well I blasted that deployment and created a new deployment.. Currently trying to figure out how to restore .kibana\_1 and .security-6. Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![Eric\_Moss](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@Eric\_Moss](https://discuss.elastic.co/u/Eric_Moss)\
**Post date:** [March 11, 2019, 4:50pm UTC](https://discuss.elastic.co/t/issue-with-restoring-kibana-1-and-security-6-indices/171579/4 "2019-03-11T16:50:28Z")

</div>

Ok... so I can't seem to find a complete restore option. However, I've managed to restore the .kibana\_1 and .security-6 indices to different indexes and reindex back into the .kibana\_1 and .security-6 indexes respectively. The caveat here is that you must set "include\_aliases" to false or it will hose your existing instances. I've provided an example of the security index below:

POST /\_snapshot/s3repo/scheduled-1551871948-instance-0000000003/_restore  
{  
"indices": ".security\*",  
"ignore\_unavailable": true,  
"include\_global\_state": false,  
"rename\_pattern": "(.+)",  
"rename\_replacement": "restored_$1",  
"include\_aliases":false  
}

POST _reindex  
{  
"source": {  
"index": "restored_.security-6"  
},  
"dest": {  
"index": ".security-6"  
}  
}

that being said, ES should really have a full restore option available or at least documented for ECE and/or other contexts. Love the product, you're docs are trash. Specifically, the fact that there are different things that apply for ECE vs the traditional model. I've pushed my Fortune 500 company to get Platinum licensing, I hope this wasn't a mistake.

---

<div class="post-metadata">

**Author:** ![Eric\_Moss](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@Eric\_Moss](https://discuss.elastic.co/u/Eric_Moss)\
**Post date:** [March 11, 2019, 4:51pm UTC](https://discuss.elastic.co/t/issue-with-restoring-kibana-1-and-security-6-indices/171579/5 "2019-03-11T16:51:19Z")

</div>

i.e. you cant change the port or subdomain in ECE. it's not documented anywhere. just one of many examples i can provide.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 8, 2019, 4:51pm UTC](https://discuss.elastic.co/t/issue-with-restoring-kibana-1-and-security-6-indices/171579/6 "2019-04-08T16:51:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.