I had a cluster node restart while another the cluster was still recovering from another node crashing which resulted in some indexes with missing shards. None of the affected indexes are currently being written and I have snapshots of them.
To recover the missing shards should I just restore the indexes from a snapshot that has all the indexes in their full state.
one further point is that some of the indexes are part of a datastream. Presumably will have to fiddle with those to get them back into the data streams.
Further though will I have to delete the incomplete indexes before attempting to do the restore?
Thought we covered that here but perhaps a different use case...
@Russell_Fulton You got me thinnking about this and the answer is Yes!
So this is what I did ... I had a data stream Istio Logs
My Case I deleted this backing index
Then set it as a "custom" index pattern in the restore UI
[Screenshot 2023-08-29 at 5.03.10 PM]
Then Restored it
[Screenshot 2023-08-29 at 5.03.03 PM]
At this point the backing index is restored... but I could not see the data in places...
BTW it can take a while to r…
@Stephenb (again ;), my question really was about whether I should delete the index with missing shards before doing the restore and added the other details as an afterthought.
It turns out you have to either close or delete an index before you can restore it so I deleted them.
I now have restored the affected indices and linked the two that were part of a datastream as per
@Stephenb 's response to an earlier question.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.