Watcher to create snapshot and restore snapshot

I am trying to create a watcher to create a snapshot and another watcher to restore the same snapshot then delete it.

to take the snapshot I have

POST _watcher/watch/test
  "trigger": {
    "schedule": {
      "interval": "30m"
  "actions": {
    "take_snapshot_kibana": {
      "webhook": {
        "method": "PUT",
        "port": 9200,
        "scheme": "https",
        "host": "localhost"
        "path": "/_snapshot/s3/snapshot_kibana",
        "body": ""

and in the body I want to set it so that it only takes the .kibana like
"indices": ".kibana",
"ignore_unavailable": true,

so how would you format the body portion ?

ultimately I am wanting to replicate all of .kibana and .logstash from one cluster to another.

Take a look at the Snapshot Lifecycle Management - also there is a nice UI for this if you do not want to fiddle with the API endpoints. See the kibana docs at

There is no need for watcher here, Elasticsearch offers this out of the box.

I am trying to setup a automated backup/restore of .kibana(for saved objects) and .logstash(for pipelines) indexes onto another cluster for near live DR setup. in the SLM i know that you can setup policies for backups on schedule but not for restores on the remote cluster.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.