# Unable to restore snapshots in Elasticsearch

**URL:** <https://discuss.elastic.co/t/unable-to-restore-snapshots-in-elasticsearch/247179>\
**Category:** Elasticsearch\
**Created:** [September 2, 2020, 7:13am UTC](https://discuss.elastic.co/t/unable-to-restore-snapshots-in-elasticsearch/247179 "2020-09-02T07:13:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ayush\_Agrahari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_agrahari/32/74932_2.png) [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\
**Post date:** [September 2, 2020, 7:13am UTC](https://discuss.elastic.co/t/unable-to-restore-snapshots-in-elasticsearch/247179/1 "2020-09-02T07:13:20Z")

</div>

I am getting error while restoring Snapshot. Details are mentioned below

**API Call:**'POST /\_snapshot/elkSnapshots/snapshot-20200830-sdfs/\_restore?  
{  
"indices": "\*"  
}'

**Error:** {  
"error" : {  
"root\_cause" : [  
{  
"type" : "snapshot\_restore\_exception",  
"reason" : "[elkBackupS3:snap-test-20200902/izdTtzXLSTuhwQRlD6z6IA] **cannot restore index [filebeat-2020.08.18] because an open index with same name already exists in the cluster**. Either close or delete the existing index or restore the index under a different name by providing a rename pattern and replacement name"  
}  
],  
"type" : "snapshot\_restore\_exception",  
"reason" : "[elkBackupS3:snap-test-20200902/izdTtzXLSTuhwQRlD6z6IA] cannot restore index [filebeat-2020.08.18] because an open index with same name already exists in the cluster. Either close or delete the existing index or restore the index under a different name by providing a rename pattern and replacement name"  
},  
"status" : 500  
}

I found in internet to delete indices or close indices to restore. Please find my thoughts on this below  
**Delete Indices:** Even after deleting Data. Logtash keep on sending data so new indice would be created then will get same error.  
**Close Indices:** After closing indices I get error in Kibana that all indices are closed hence kibana is down.

Please suggest approach to tackle this problem.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 2, 2020, 7:15am UTC](https://discuss.elastic.co/t/unable-to-restore-snapshots-in-elasticsearch/247179/2 "2020-09-02T07:15:20Z")

</div>

Why not use a rename as per the example here - [https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-restore-snapshot.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-restore-snapshot.html)?

---

<div class="post-metadata">

**Author:** ![Ayush\_Agrahari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_agrahari/32/74932_2.png) [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\
**Post date:** [September 2, 2020, 12:18pm UTC](https://discuss.elastic.co/t/unable-to-restore-snapshots-in-elasticsearch/247179/4 "2020-09-02T12:18:55Z")

</div>

@warkolm If I rename pattern then Data will not come in filebeat dashboard as I have specified it starts with 'filebeat-_'. After renaming it would be like 'restored\_filebeat-_' then there will be no data in kibana dashboard.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 2, 2020, 9:18pm UTC](https://discuss.elastic.co/t/unable-to-restore-snapshots-in-elasticsearch/247179/5 "2020-09-02T21:18:50Z")

</div>

You can rename it however you want, so `filebeat-restored-timestamp`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 30, 2020, 9:19pm UTC](https://discuss.elastic.co/t/unable-to-restore-snapshots-in-elasticsearch/247179/6 "2020-09-30T21:19:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.