SnapShot with select indices is still using all indices

Elastic Stack Elasticsearch
1

Hello, pretty new to ES and everything related to it. Just trying to do a snapshot and only selecting a set of things from 2023 and everything with .xxx in the name as part of it, tons of old data we aren't capable of deleting but don't want in the new cluster.
However, it still seems to be pulling in every index and I'm pretty sure it's just me not knowing how to do this properly. Any help would be appreciated

PUT /_snapshot/prod/prod_onprem_2132023?wait_for_completion=false
{
  "type": "azure",
  "ignore_unavailable": true,
  "include_global_state": true,
  "settings": {
    "container": "elasticsearch-snapshots",
    "base_path" : "prod",
    "compress": true,
    "readonly": "false",
  "indices": ".kibana_1,.kibana_task_manager,.management-beats,.monitoring-*,.watcher-history*,.watches,.security-6,.tasks,.triggered_watches,logstash-bgcs-2023*,logstash-gk-2023*,logstash-wlp-web-2023*,logstash-postfix-2023*,logstash-web-2023*,logstash-ts-2023*,logstash-2023*,wlp-app-2023*,wlp-web-2023*",
  "metadata": {
    "taken_by": "admin 2/13/2023",
    "taken_because": "Snapshot for PROD, select Indices on 2/13/2023"  
   }  
  }
 }
2

Hello @tymercer , welcome to the community !
Can you please also provide the output of the command above and what is your expectation ?

3

It returns 'true' and starts the process, however when running the snapshot/current command to view the status it shows all of the indices being processed and not just the ones I listed.

part of the output is

{
  "snapshots" : [
    {
      "snapshot" : "prod__2132023",
      "uuid" : "7pySij8rSrq1GoXZu35X2w",
      "version_id" : 6081299,
      "version" : "6.8.12",
      "indices" : [
        "logstash-2022.05.30",
        "logstash-2022.04.27",
        ".monitoring-es-6-2023.02.12",
        "logstash-postfix-2022.33",
        "logstash-web-2022.40",
        "logstash-2021.10.22",
        "logstash-2022.10.31",
        "logstash-app-2022.30",
        "logstash-2022.08.31",
        "logstash-web-2023.07",
        "logstash-app-2021.52",
      "include_global_state" : true,
      "state" : "IN_PROGRESS",
      "start_time" : "2023-02-14T12:20:03.726Z",
      "start_time_in_millis" : 1676377203726,
      "end_time" : "1970-01-01T00:00:00.000Z",
      "end_time_in_millis" : 0,
      "duration_in_millis" : 0,
      "failures" : [ ],
      "shards" : {
        "total" : 0,
        "failed" : 0,
        "successful" : 0

I would expect it to only show the indices I selected, but it is processing everything.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.