Restore elasticsearch cluster onto another cluster

[auto_reply_007]

Hello i have 3 node elasticsearch cluster ( source ) and i have snapshot called snapshot-1 which taken from source cluster and i have another 6 node elasticsearch cluster ( destination ) cluster

and when i restore my destinatition cluster from snapshot-1 using this command

curl -X POST -u elastic:321 "192.168.2.15:9200/snapshot/snapshot_repository/snapshot-1/_restore?pretty" -H 'Content-Type: application/json' -d'

> {
> "indices": "*",
> "ignore_unavailable": true,
> "include_global_state": false,
> "rename_pattern": ".security(.+)",
> "rename_replacement": "delete_$1",
> "include_aliases": false
> }
> '
{

and i got this error

"error" : {

"root_cause" : [

  {

    "type" : "snapshot_restore_exception",

    "reason" : "[snapshot:snapshot-1 yjg/mHsYhycHQsKiEhWVhBywxQ] cannot restore index [.ilm-history-0003] because an open index with same name already exists in the cluster. Either close or delete the existing index or restore the index under a different name by providing a rename pattern and replacement name"

  }

so as you can see the index .ilm-history-0003 already exists in the cluster, but how can i do rename replacement for security,.ilm,.slm,.transfrom indices using only 1 rename_pattern? like this one

"rename_pattern": ".security(.+)",

[warkolm (Mark Walkom)]

Welcome to our community!

I don't believe that you can have multiple rename_pattern in there, so you can either have a global one that renames all indices, or use Multi-target syntax | Elasticsearch Guide [7.14] | Elastic to be a bit more explicit with your restored index names.

[auto_reply_007]

hello! thank you !!
so in this case i can use this pattern?

curl -X POST -u elastic:321 "192.168.2.15:9200/snapshot/snapshot_repository/snapshot-1/_restore?pretty" -H 'Content-Type: application/json' -d'

> {
> "indices": "*, -.slm,-,ilm,-.transfrom,-security",
> "ignore_unavailable": true,
> "include_global_state": false,
> "include_aliases": false
> }
> '
{

is this okay?

[warkolm (Mark Walkom)]

Yep that should work.