# Snapshot Restore - Index green & present with data, but missing data

**URL:** https://discuss.elastic.co/t/snapshot-restore-index-green-present-with-data-but-missing-data/284944
**Category:** Elasticsearch
**Tags:** snapshot-and-restore
**Created:** [September 22, 2021, 9:30pm UTC](https://discuss.elastic.co/t/snapshot-restore-index-green-present-with-data-but-missing-data/284944 "2021-09-22T21:30:53Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![elasticband](https://avatars.discourse-cdn.com/v4/letter/e/977dab/32.png) [@elasticband](https://discuss.elastic.co/u/elasticband)
#### Post date: [September 22, 2021, 9:30pm UTC](https://discuss.elastic.co/t/snapshot-restore-index-green-present-with-data-but-missing-data/284944/1 "2021-09-22T21:30:53Z")

</div>

Hello everyone,

I am fairly new to this whole ES thing, but I am getting through the trial by fire on my first misconfiguration. I ended up doing a snapshots from my multi node cluster and restored it to a single node to fix some other stuff.

Anyway the issue I am having is when I do the restore from the snapshot I can take a look and see the index and shard present, green, and containing gigabytes of data; however, I am seeing that I am missing around half the data for specific windows of time. This is a SIEM implementation and I have at least 3 separate data holes. The first two are around 2 days long, and another 1 days long. I will note the I am not seeing any errors on the restore.

Here is the restore curl:

> Restore curl:  
> `curl -k -X POST -u <user>:password "https://localhost:9200/_snapshot/my_backup10/my_snapshot_0830/_restore?wait_for_completion=true&pretty" -H 'Content-Type: application/json' -d' { "indices": "<index1>,<index2>", "include_global_state": false, "rename_pattern": "so-(.+)", "rename_replacement": "so-$1-r10pp", "include_aliases": false } '`

I have to list each and every index that I would like to restore, if I leave it blank it only restores the hidden index starting with a period (.). I am changing the name so I do not have an collisions.

Original Server:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/6/769057def94f0519294daf7b9236a6b08023b497.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/3/839c3f48dab571b9665c306ec23f439001717136.png)

Restored Server:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/e/be3c3a5c278ceb36f56cf9ee07a8f0ade71d8e40.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/9/49a6e4220df59e9c4de85cedb6b4c61951fcfaa4.png)

Curling the shards: curl -k -XGET -u user:pass "[https://localhost:9200/\_cat/shards?](https://localhost:9200/_cat/shards?)" | grep 8.19  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a67414b381e6555ae7c1159df5ca510995419295.png)

Any idea what I could be doing wrong that basically 90% of all the data was restored, but I had these 'hole' every once and a while? Any help would be very much appreciated.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 20, 2021, 9:31pm UTC](https://discuss.elastic.co/t/snapshot-restore-index-green-present-with-data-but-missing-data/284944/2 "2021-10-20T21:31:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.