I am new to ELK. I had some previous visualizations and dashboards which i made which I can't see in kibana. i think It is because I moved elasticsearch and logstash directory to other location. Can I get back old data?
I'm assuming that you have done more work on your Elasticsearch cluster already that you don't want to loose. Do you still have a copy of the Elasticsearch data directory in its old location? If yes, you could simply spin up another Elasticsearch node and configure it with the old data directory. Attach Kibana to it and export your dashboards and visualisations from the Saved Objects page. You can then import the resulting JSON file into your new Kibana/Elasticsearch.
Thanks for the fast reply. As you asked, I still have a copy of old directory. As a beginner, I have trouble understanding your solution. Can you please elaborate it ? How do I spin up another Elasticsearch node.
Not knowing much about your environment, I assume that at some point you reconfigured Elasticsearch to use a different location for its data. This is done through the path settings.
It may be easiest if you temporarily undo you changes and configure Elasticsearch again to look at the previous data path. You need to restart Elasticsearch (and Kibana) for this to take effect. Make sure that all nodes in the cluster point to either the old or the new data location. Mixing the two has a high probability of leading to data loss.
When Elasticsearch looks at the old data location (which will contain the .kibana index that holds the dashboards), you can export your previous dashboards through the Kibana Management > Saved Objects. This produces a JSON file with the exported dashboards.
Then, after shutting down Elasticsearch (and Kibana) again, configure Elasticsearch to point to your new, current data location again. Once Elasticsearch (and Kibana) have started again, you can import your saved dashboards in Kibana Management > Saved Objects.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.