Watcher to create snapshot and restore snapshot

Elastic Stack Elasticsearch
1

I am trying to create a watcher to create a snapshot and another watcher to restore the same snapshot then delete it.

to take the snapshot I have

POST _watcher/watch/test
{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "actions": {
    "take_snapshot_kibana": {
      "webhook": {
        "method": "PUT",
        "port": 9200,
        "scheme": "https",
        "host": "localhost"
        "path": "/_snapshot/s3/snapshot_kibana",
        "body": ""
      }
    }
  }
}

and in the body I want to set it so that it only takes the .kibana like
{
"indices": ".kibana",
"ignore_unavailable": true,
}

so how would you format the body portion ?

ultimately I am wanting to replicate all of .kibana and .logstash from one cluster to another.

2

Take a look at the Snapshot Lifecycle Management - also there is a nice UI for this if you do not want to fiddle with the API endpoints. See the kibana docs at https://www.elastic.co/guide/en/kibana/7.6/snapshot-repositories.html#snapshot-repositories

There is no need for watcher here, Elasticsearch offers this out of the box.

3

I am trying to setup a automated backup/restore of .kibana(for saved objects) and .logstash(for pipelines) indexes onto another cluster for near live DR setup. in the SLM i know that you can setup policies for backups on schedule but not for restores on the remote cluster.