Undo index to searchable snapshot conversion

[alexs1]

Hello

My question is:
Once I checked the searchable snapshot in the ILM cold phase, the index settings, ilm settings and more have changed (as expected)

Is there a way to "undo" this step, and return it to be a regular index with a replica etc..?

Thank you!

[DavidTurner]

@alexs1

Is there a way to "undo" this step, and return it to be a regular index with a replica etc..?

If it's just replicas you want, you can add them to searchable snapshots just like regular indices: just set the index setting index.number_of_replicas or index.auto_expand_replicas.

If you want to move it back to a regular index for some other reason, you can restore the snapshot that sits behind the searchable snapshot index: it's just a normal snapshot. I believe the resulting index won't be ILM-managed however.

[alexs1]

thanks a lot!

when looking in snapshots & restore page inKIbana, the original index name it's not in the last snaphot indices list,

instead there is another one: restored-{original-index-name*}, which also exists in the cluster's indices of course, and have the original name as an alias.

I guess that means, that it was restored automatically during a search?

how can I know it includes the entire original data of the index, as I've read in the documentation, that there can be a partial restore or a full- depends on the search query.

my goal is to restore the original index back to the cold tier

thank you!

[alexs1]

@DavidTurner do you think that there is a way to restore the original index?

[DavidTurner]

Yes, use the restore snapshot API. I'm not familiar with the UI in Kibana but I imagine you can do it through that too.

@alexs1

how can I know it includes the entire original data of the index, as I've read in the documentation, that there can be a partial restore or a full- depends on the search query.

The snapshot always contains everything, and a regular restore will always copy everything into the cluster. The partial-vs-full thing only applies to searchable snapshot indices, not the underlying snapshot.

[alexs1]

thanks a lot for getting back @DavidTurner

the issue I'm having is the the original index doesn't appear in the snapshot, but another version of it: "restored-[original index name]", which also exists in the cluster

when trying to restore I get an error

cannot restore index [restored-.....-000009] because an open index with same name already exists in the cluster. Either close or delete the existing index or restore the index under a different name by providing a rename pattern and replacement name

[DavidTurner]

Oh I see. The snapshot that backs the searchable snapshot index is identified in its index settings, so GET /restored-...-000009/_settings?flat_settings should tell you what you need to restore.

[alexs1]

perfect thanks!