Hi all,
So we are using EFK stack for logging purposes. We have ES at 7.17.23 and filebeat at 7 version. Unfortunately on some of the machines, the filebeat got upgraded to 8 , it forcefully modified the Index template that is connected to the filebeat to have Data Streams enabled. So every day the index is getting created is not regular index but rather its a datastream. I tried forcefully changing back the index template without successfully.
We have a cron job to trigger the snapshots on the regular indices, So we used to that to create the snapshots on the indices created by these data streams but when we tried to restore it back to regular index from the snapshot. I have been unsuccessful. Any suggestions or directions I can follow, I would highly appreciate it.
Thanks,
Kushal