Not getting search result after restoring index

Elastic Stack Elasticsearch
1

I restored old index which I archived last week. The archive was success but I'm still not getting the results for the dates for which I restored the index.

Get _cat/indices?v&s=store.size - shows all index in green after restoring

I used below command to restore the index

post /snapshot/backup2018-01/2018_08.3/restore
{
"indices":"test_2018_08_08,test_2018_08_09",
"ignore_unavailable": true,
"include_global_state": false,
"rename_pattern": "test(.+)",
"rename_replacement": "restored_test$1",
"index_settings": {
"index.number_of_replicas": 0
}
}

can any one please help me in resolving the issue and get the data.

2

please provide more information.

What was the response of that restore operation? are the indices being created successfully? what is the output of GET _cat/indices/test_2018_08_08, test_2018_08_09? What query did you execute? what version are you running on?

3

Hi Alexnder,
Thanks for your response .
Yes the index is created successfully.

Result of GET _cat/indices/test_2018_08_08, test_2018_08_09
green open restored_test_2018_08_08 zogqq7K2ReWUaJCSc91Oeg 5 0 286135457 0 490gb 490gb
green open restored_test_2018_08_09 VJ5thNzGShqMC89xPPDcbQ 5 0 242446832 0 415gb 415gb

I just filtered to get all logs for 8th and 9th of August. But I got no records found message. I'm not sure how to get the version.

Result of Get _cat/indices?v&s=store.siz
green open restored_test_2018_08_08 VJ5thNzGShqMC89xPPDcbQ 5 0 242446832 0 415gb 415gb
green open restored_test_2018_08_07 cSFcSD0GQhG0qzJjQK5CrA 5 0 263494277 0 452.3gb 452.3gb
green open restored_test_2018_08_06 zogqq7K2ReWUaJCSc91Oeg 5 0 286135457 0 490gb 490gb

4

the Elasticsearch version was what I was referring to, just paste the output of the / endpoint.

Can you run a GET restored_test_2018_08_08/_search operation and check what is returned. Are those valid . documents? What kind of documents are in there?

5

Below is the response I have removed

Version details

{
"name": "MyKibana-diag-kibana",
"cluster_name": "MyKibana-diag",
"cluster_uuid": "123",
"version": {
"number": "5.6.3",
"build_hash": "1a2f265",
"build_date": "2017-10-06T20:33:39.012Z",
"build_snapshot": false,
"lucene_version": "6.6.1"
},
"tagline": "You Know, for Search"
}

6

Out put of GET restored_test_2018_08_08/_search I have removed some sensitive data from response.

{

"took": 1324,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 242446832,
"max_score": 1,
"hits": [
{
"_index": "restored_test_2018_08_08",
"_type": "event",
"_id": "f8337994-4bc1-4eb1-8326-67037adeb42d",
"_score": 1,
"_source": {
"id": "f8337994-4bc1-4eb1-8326-67037adeb42d",
"instanceId": null,
"eventName": "NewWeatherReceived",
"activityId": "3958bdba-910c-4194-9e52-59e226823fc2",
"formattedMessage": null,
"timestamp": "2018-08-04T23:39:52.8916301Z",
"level": "Informational",
"task": null,
"providerName": "Test-MyLogic",
"nodeName": null,
"payload": {
"deviceId": "123"
}
}
},
{
"_index": "restored_test_2018_08_08",
"_type": "event",
"_id": "7cb520c4-1119-4877-8d5d-62f3e28d4a14",
"_score": 1,
"_source": {
"id": "7cb520c4-1119-4877-8d5d-62f3e28d4a14",
"instanceId": null,
"eventName": "MessageEnqueued",
"activityId": "3958bdba-910c-4194-9e52-59e226823fc2",
"formattedMessage": null,
"timestamp": "2018-08-04T23:39:52.8974111Z",
"level": "Informational",
"task": null,
"providerName": "Test-MyLogic",
"nodeName": null,
"payload": {
"deviceId": "123",
"changeId": "",
"changeName": "weatherReport",
"protocolMethod": "MyReport"
}
}
},
{
"_index": "restored_test_2018_08_08",
"_type": "event",
"_id": "0932e505-263f-48c5-9f43-fe2db69e0062",
"_score": 1,
"_source": {
"id": "0932e505-263f-48c5-9f43-fe2db69e0062",
"instanceId": null,
"eventName": "MessageReceived",
"activityId": "3f6abf87-3d13-4ebe-921e-1230f721facd",
"formattedMessage": null,
"timestamp": "2018-08-04T23:39:52.9680479Z",
"level": "Always",
"task": null,
"providerName": "Test-MyReceiver",
"nodeName": null,
"payload": {
"deviceId": "234",
"partitionKey": "",
"eventOffset": "40712026389064",
"enqueuedTimeUtc": "2018-08-04T23:40:23.94+00:00",
"serializedSizeInBytes": 314,
"properties": "",
"systemProperties": "",
"body": "",
"totalMilliseconds": 2555904
}
}
},
{
"_index": "restored_test_2018_08_08",
"_type": "event",
"_id": "17b8e633-ebab-4761-875c-6a49cea92224",
"_score": 1,
"_source": {
"id": "17b8e633-ebab-4761-875c-6a49cea92224",
"instanceId": null,
"eventName": "MessageReceived",
"activityId": "efa8f64c-fc87-4336-9956-1403dee3555a",
"formattedMessage": null,
"timestamp": "2018-08-04T23:39:52.9682417Z",
"level": "Always",
"task": null,
"providerName": "Test-MyReceiver",
"nodeName": null,
"payload": {
"deviceId": "345",
"partitionKey": "",
"eventOffset": "40712026390664",
"enqueuedTimeUtc": "2018-08-04T23:40:23.94+00:00",
"serializedSizeInBytes": 316,
"properties": "",
"body": "",
"totalMilliseconds": 2555904
}
}
},
{
"_index": "restored_test_2018_08_08",
"_type": "event",
"_id": "8951de1e-ef5f-449e-b9b4-88de055b777f",
"_score": 1,
"_source": {
"id": "8951de1e-ef5f-449e-b9b4-88de055b777f",
"instanceId": null,
"eventName": "MessageReceived",
"activityId": "6a1db078-1bbc-459d-b64c-65d1989263c1",
"formattedMessage": null,
"timestamp": "2018-08-04T23:39:52.9807449Z",
"level": "Always",
"task": null,
"providerName": "Test-MyReceiver",
"nodeName": null,
"payload": {
"deviceId": "456",
"partitionKey": "",
"eventOffset": "42064934436440",
"enqueuedTimeUtc": "2018-08-04T23:40:23.978+00:00",
"serializedSizeInBytes": 317,
"properties": "",
"systemProperties": "",
"body": "",
"totalMilliseconds": 1048576
}
}
},
{
"_index": "restored_test_2018_08_08",
"_type": "event",
"_id": "46ca0923-26fb-451d-bde7-c7102e1f675a",
"_score": 1,
"_source": {
"id": "46ca0923-26fb-451d-bde7-c7102e1f675a",
"instanceId": null,
"eventName": "MessageReceived",
"activityId": "645a414d-157c-4fa5-b618-1217265c65f7",
"formattedMessage": null,
"timestamp": "2018-08-04T23:39:52.9821085Z",
"level": "Always",
"task": null,
"providerName": "Test-MyReceiver",
"nodeName": null,
"payload": {
"deviceId": "567",
"partitionKey": "",
"eventOffset": "40424249743544",
"enqueuedTimeUtc": "2018-08-04T23:40:23.942+00:00",
"serializedSizeInBytes": 413,
"properties": "",
"body": "",
"totalMilliseconds": 3407872
}
}
}
]
}
}

7

Previous response had long Json. I deleted it because of size limitation.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.