Restoring selected indexes from a snapshot using regex in Curator?


I would like to restore selected indexes based on regex from ElasticSearch Snapshot using Curator.

For example while taking a snapshot of selected indexes we can mention the regex in filtertype as below

  - filtertype: pattern
    kind: regex
    value: '^value-trans-'

Can we apply a similar regex while restoring a snapshot? I want to restore only the selected indexes which are created everyday with a name like value-trans-2021-08-19. In this case I want to restore only the indexes with the prefix value-trans-

Pradeep GM

Elasticsearch is the tool in question here. Curator will not use regular expressions (not currently, anyway) to select which indices to restore from the list in the snapshot metadata. The indices parameter is used by Elasticsearch, and its value is merely passed by Curator.

According to the Elasticsearch documentation:

Use the indices parameter to restore only specific data streams or indices. This parameter supports multi-target syntax.

Regarding multi-target syntax:

In multi-target syntax, you can use a comma-separated list to run a request on multiple resources, such as data streams, indices, or aliases: test1,test2,test3 . You can also use glob-like wildcard ( * ) expressions to target resources that match a pattern: test* or *test or te*t or *test* .

You can exclude targets using the - character: test*,-test3 .

There is a caveat that if an alias is referenced by a glob-like wildcard, it will restore the associated index.

For example, if test3 is an index alias, the pattern test*,-test3 still targets the indices for test3 . To avoid this, exclude the concrete indices for the alias instead.

Thanks Theuntergreek, it helped. I given as below

    action: restore
    description: >-
      repository: es-snapshot-current
      indices: [value-trans-*]
      wait_for_completion: true
      max_wait: -1
      wait_interval: 10
      - filtertype: none

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.