Unable to open apm index after closing all

Kibana version : 7.6

Elasticsearch version : 7.6

APM Server version : 7.3.2

APM Agent language and version : java 1.9.0

Fresh install or upgraded from other version? fresh install

Is there anything special in your setup? For example, are you using the Logstash or Kafka outputs? Are you using a load balancer in front of the APM Servers? Have you changed index pattern, generated custom templates, changed agent configuration etc. :----no

I was trying to do a restore snapshot and closed all the indexes as an error was shown to close the index for restoring. But now I am not able to do any operation on indexes. I try to open an index and I am getting below error. I tried POST /.*/_open and POST /.kibana_1/_open . everything leads to below error. How can I continue working?

{"message":"closed: [index_closed_exception] closed, with { index_uuid="sTrUswmeTvOnvofMH1C9GA" & index=".kibana_1" }","statusCode":400,"error":"Bad Request"}

Hi @anjana1,
it looks like you closed a Kibana system index. I can reproduce the error when sending a request from Kibana after closing the Kibana system index .kibana_1.
Sending the same request via curl instead of from the Kibana console worked for me and reopened the system index. Could you try to send the request via curl?

Could you throw some light on how to restore the data once I did an upagrade. I am migrating from 7.6 to 7.7.1 . I already took a snapshot from my older version. How can I restore the data in 7,7.1. When I do a snapshot restore from upgraded version it asks me to close the index. But once index is closed kibana cannot relaunched so how will I restore the snapshot..Should I use curl commands for restore as well in that case?

The Kibana Snapshot and Restore docs should guide you through the process of creating snapshots and restoring them.

In case you are trying to restore an index into the cluster that already exists in the cluster and is open, you will receive an error. It really depends on what you are trying to do here.

Generally speaking, when you upgrade your cluster from 7.6 to 7.7 it should not be necessary to restore the APM indices, the apm-7.6* indices should still be there and the 7.7 APM UI will continue to work with these indices. Have you experienced any issues after upgrading to 7.7 that are causing you to restore data?

When we upgrade from 7.6 to 7.7 how are we supposed to carry over data and indices over to new upgraded version ? Are we copying over the data folder?

Could you let me know whether you are running the elastic stack on-prem or as a hosted version, and if it is on-prem how you installed it (package manager, docker, etc)?

I am running it on-prem and I have installed by downloading the zip as a package fro windows. Unzip the jar and ran the bat file

Hi @anjana1,
sorry for being confusing before - taking a snapshot and restoring it from one installation to the other might not be required, depending on the deployment type, but it is perfectly fine to do so.

If you try to restore any index that already exists in the cluster, you will see the above mentioned error. If that happens, you either need to close or delete the existing index in the new cluster or you restore the index from the snapshot under a different name.
I am not clear if you would really like to restore all the system indices (that also exist in the new cluster) or if your goal is to restore only the apm indices. In the case of APM you can specify to only restore APM indices (see screenshot). These indices should not exist in your new deployment, as the indices are versioned.

Let me know if that solves your issues.

1 Like

Thanks .I was able to restore the indices , but I see that the entire apm related data is not transferred over . I only see the data partially being restored. But I have multiple apm versions in my snapshots like 7.3 , 7.2. Does that mean that data is spread across all these indices.

@simitt.. One more addition to the above. I started development using apm-7.3 and then apm7.5, apm 7.6 and now its 7.7. To get back all my data after snapshot restore I had to end up restoring all the above apm versions . I think some of the apm span labels that I created are done from earlier versions . So for getting those data I had to get te earlier versions also. is that how its supposed t work?

that's how apm indexes are right now and then only I see the entire data. if I just restore the last version its not fully restored

APM indices start with the pattern apm-{version}-{event_type}, therefore it is expected that indices are created per version. This allows to easily add new mappings etc for new features on version upgrades. When you are creating snapshots and restore them, you need to do this for all APM indices that you would like to be restored, but you should be able to select them all at once.

@simitt .. Thanks for the reply ..so what is a best practice , do we need to restore all the apm-{version}-{event_type} or only the current one ?

@anjana1, that depends on your use cases and upgrade-frequency. If you would like to see trends over time, then data from previous versions can be helpful, if you are mainly focused on insights about the current status, then restoring older data might not be necessary.

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.