Create, list and restore Elasticsearch snapshots.
Create elasticsearch snapshot directory.
$ sudo install --owner elasticsearch --group elasticsearch --directory /srv/elasticsearch
Determine systemd mount name.
$ systemd-escape --path srv/elasticsearch
srv-elasticsearch
Create NFS mount that will be shared among all nodes.
$ sudo tee /etc/systemd/system/srv-elasticsearch.mount <<EOF [Unit] Description=Mount NFS share After=network-online.target Wants=network-online.target [Mount] What=192.168.8.171:/elasticsearch Where= /srv/elasticsearch Options=rw,auto Type=nfs TimeoutSec=60 [Install] WantedBy=remote-fs.target EOF
Enable NFS mount.
$ sudo systemctl enable --now srv-elasticsearch.mount
Created symlink /etc/systemd/system/remote-fs.target.wants/srv-elasticsearch.mount → /etc/systemd/system/srv-elasticsearch.mount.
Ensure that path.repo is defined and contains one or multiple shared directories.
$ sudo cat /etc/elasticsearch/elasticsearch.yml
node:
name: elastic-2
roles: [ master, data ]
network:
host: 192.168.8.159
cluster:
name: elasticsearch-cluster
initial_master_nodes:
- elastic-1
- elastic-2
- elastic-3
discovery:
seed_hosts:
- 192.168.8.153
- 192.168.8.159
- 192.168.8.163
bootstrap:
memory_lock: "true"
path:
data: /var/lib/elasticsearch
logs: /var/log/elasticsearch
repo: ["/srv/elasticsearch"]
xpack:
security:
autoconfiguration:
enabled: false
enrollment:
enabled: true
transport:
ssl:
enabled: true
verification_mode: certificate
client_authentication: required
keystore:
path: certs/elastic-certificates.p12
http:
ssl:
enabled: true
keystore:
path: certs/http.p12
Restart elasticsearch service.
$ sudo systemctl restart elasticsearch
Register snapshot repository.
$ curl -X PUT -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch?pretty" \
-H 'Content-Type: application/json' -d'{"type":"fs","settings":{"location":"/srv/elasticsearch"}}'
{
"acknowledged" : true
}
List snapshot repositories.
$ curl -u elastic:************ "https://192.168.8.153:9200/_snapshot?pretty"
{
"srv-elasticsearch" : {
"type" : "fs",
"settings" : {
"location" : "/srv/elasticsearch"
}
}
}
Verify snapshot repository.
$ curl -X POST -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch/_verify?pretty"
{
"nodes" : {
"zMOB-MsFTmWZ1-358e6cqQ" : {
"name" : "elastic-4"
},
"OHDoU4CbTiO3ykkE9-IysA" : {
"name" : "elastic-5"
},
"Cp-IujVJQn6id__fxCG4jA" : {
"name" : "elastic-2"
},
"gcJVti6eRuiagreCbH6Qsg" : {
"name" : "elastic-3"
},
"HlMrDM6RSCCEYaMJgBcPJA" : {
"name" : "elastic-1"
}
}
}
Create snapshot.
$ curl -X PUT -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch/snapshot-$(date +%Y%m%d%H%M)?pretty"
I have created fully fledged snapshot, but consider backing up only your precious data.
$ curl -X POST -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch/snapshot-$(date +%Y%m%d%H%M)?pretty" \
-H 'Content-Type: application/json' -d'{ "indices": ".apm-source-map"}'
{
"accepted" : true
}
Inspect snapshot operation.
$ curl -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch/_current?pretty"
{
"snapshots" : [
{
"snapshot" : "snapshot-202307250737",
"uuid" : "vRcmnfIaQKmBdN6nAB99Mg",
"repository" : "srv-elasticsearch",
"version_id" : 8080299,
"version" : "8.8.2",
"indices" : [
".kibana_8.8.2_001",
".fleet-files-agent-000001",
".security-7",
".apm-agent-configuration",
".kibana_alerting_cases_8.8.2_001",
".internal.alerts-observability.metrics.alerts-default-000001",
".ds-.monitoring-es-8-mb-2023.07.23-000001",
".kibana_security_solution_8.8.2_001",
".internal.alerts-security.alerts-default-000001",
".ds-metricbeat-8.8.2-2023.07.23-000001",
".fleet-file-data-agent-000001",
".internal.alerts-observability.logs.alerts-default-000001",
".internal.alerts-observability.apm.alerts-default-000001",
".kibana_analytics_8.8.2_001",
".kibana_ingest_8.8.2_001",
".apm-custom-link",
".apm-source-map",
".ds-.logs-deprecation.elasticsearch-default-2023.07.23-000001",
".async-search",
".kibana_security_session_1",
".ds-ilm-history-5-2023.07.23-000001",
".internal.alerts-observability.slo.alerts-default-000001",
".internal.alerts-observability.uptime.alerts-default-000001",
".kibana_task_manager_8.8.2_001",
".kibana-event-log-8.8.2-000001",
".security-profile-8"
],
"data_streams" : [
"ilm-history-5",
".logs-deprecation.elasticsearch-default",
"metricbeat-8.8.2",
".monitoring-es-8-mb"
],
"include_global_state" : true,
"state" : "IN_PROGRESS",
"start_time" : "2023-07-25T07:37:34.933Z",
"start_time_in_millis" : 1690270654933,
"end_time" : "1970-01-01T00:00:00.000Z",
"end_time_in_millis" : 0,
"duration_in_millis" : 0,
"failures" : [ ],
"shards" : {
"total" : 26,
"failed" : 0,
"successful" : 22
},
"feature_states" : [
{
"feature_name" : "async_search",
"indices" : [
".async-search"
]
},
{
"feature_name" : "security",
"indices" : [
".security-7",
".security-profile-8"
]
},
{
"feature_name" : "kibana",
"indices" : [
".kibana_security_solution_8.8.2_001",
".kibana_task_manager_8.8.2_001",
".apm-custom-link",
".apm-agent-configuration",
".kibana_security_session_1",
".kibana_8.8.2_001",
".kibana_alerting_cases_8.8.2_001",
".kibana_ingest_8.8.2_001",
".kibana_analytics_8.8.2_001"
]
}
]
}
],
"total" : 1,
"remaining" : 0
}
$ curl -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch/_current?pretty"
{
"snapshots" : [ ],
"total" : 0,
"remaining" : 0
}
List snapshots.
$ curl -u elastic:************ "https://192.168.8.153:9200/_cat/snapshots/srv-elasticsearch?v"
id repository status start_epoch start_time end_epoch end_time duration indices successful_shards failed_shards total_shards snapshot-202307250737 srv-elasticsearch SUCCESS 1690270654 07:37:34 1690270683 07:38:03 28.2s 26 26 0 26
Display snapshot status.
$ curl -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch/snapshot-202307250737/_status?pretty"
{
"snapshots" : [
{
"snapshot" : "snapshot-202307250737",
"repository" : "srv-elasticsearch",
"uuid" : "vRcmnfIaQKmBdN6nAB99Mg",
"state" : "SUCCESS",
"include_global_state" : true,
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 26,
"failed" : 0,
"total" : 26
},
"stats" : {
"incremental" : {
"file_count" : 515,
"size_in_bytes" : 1105997483
},
"total" : {
"file_count" : 515,
"size_in_bytes" : 1105997483
},
"start_time_in_millis" : 1690270654933,
"time_in_millis" : 28221
},
"indices" : {
".internal.alerts-observability.slo.alerts-default-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655680,
"time_in_millis" : 201
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655680,
"time_in_millis" : 201
}
}
}
},
".kibana_security_session_1" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 7,
"size_in_bytes" : 13424
},
"total" : {
"file_count" : 7,
"size_in_bytes" : 13424
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 200
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 7,
"size_in_bytes" : 13424
},
"total" : {
"file_count" : 7,
"size_in_bytes" : 13424
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 200
}
}
}
},
".kibana_8.8.2_001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 19,
"size_in_bytes" : 72536
},
"total" : {
"file_count" : 19,
"size_in_bytes" : 72536
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 2202
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 19,
"size_in_bytes" : 72536
},
"total" : {
"file_count" : 19,
"size_in_bytes" : 72536
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 2202
}
}
}
},
".internal.alerts-observability.apm.alerts-default-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655480,
"time_in_millis" : 200
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655480,
"time_in_millis" : 200
}
}
}
},
".kibana_ingest_8.8.2_001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 22,
"size_in_bytes" : 528132
},
"total" : {
"file_count" : 22,
"size_in_bytes" : 528132
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 15630
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 22,
"size_in_bytes" : 528132
},
"total" : {
"file_count" : 22,
"size_in_bytes" : 528132
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 15630
}
}
}
},
".ds-.logs-deprecation.elasticsearch-default-2023.07.23-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 28,
"size_in_bytes" : 102662
},
"total" : {
"file_count" : 28,
"size_in_bytes" : 102662
},
"start_time_in_millis" : 1690270655933,
"time_in_millis" : 801
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 28,
"size_in_bytes" : 102662
},
"total" : {
"file_count" : 28,
"size_in_bytes" : 102662
},
"start_time_in_millis" : 1690270655933,
"time_in_millis" : 801
}
}
}
},
".internal.alerts-observability.metrics.alerts-default-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 200
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 200
}
}
}
},
".apm-custom-link" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 200
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 200
}
}
}
},
".internal.alerts-security.alerts-default-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655680,
"time_in_millis" : 201
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655680,
"time_in_millis" : 201
}
}
}
},
".security-profile-8" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 4,
"size_in_bytes" : 8759
},
"total" : {
"file_count" : 4,
"size_in_bytes" : 8759
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 2002
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 4,
"size_in_bytes" : 8759
},
"total" : {
"file_count" : 4,
"size_in_bytes" : 8759
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 2002
}
}
}
},
".kibana_alerting_cases_8.8.2_001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 4,
"size_in_bytes" : 6947
},
"total" : {
"file_count" : 4,
"size_in_bytes" : 6947
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 400
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 4,
"size_in_bytes" : 6947
},
"total" : {
"file_count" : 4,
"size_in_bytes" : 6947
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 400
}
}
}
},
".kibana_security_solution_8.8.2_001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 13,
"size_in_bytes" : 44225
},
"total" : {
"file_count" : 13,
"size_in_bytes" : 44225
},
"start_time_in_millis" : 1690270655480,
"time_in_millis" : 601
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 13,
"size_in_bytes" : 44225
},
"total" : {
"file_count" : 13,
"size_in_bytes" : 44225
},
"start_time_in_millis" : 1690270655480,
"time_in_millis" : 601
}
}
}
},
".ds-metricbeat-8.8.2-2023.07.23-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 145,
"size_in_bytes" : 685112186
},
"total" : {
"file_count" : 145,
"size_in_bytes" : 685112186
},
"start_time_in_millis" : 1690270655480,
"time_in_millis" : 27641
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 145,
"size_in_bytes" : 685112186
},
"total" : {
"file_count" : 145,
"size_in_bytes" : 685112186
},
"start_time_in_millis" : 1690270655480,
"time_in_millis" : 27641
}
}
}
},
".internal.alerts-observability.logs.alerts-default-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 0
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 0
}
}
}
},
".kibana_task_manager_8.8.2_001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 37,
"size_in_bytes" : 92011
},
"total" : {
"file_count" : 37,
"size_in_bytes" : 92011
},
"start_time_in_millis" : 1690270655933,
"time_in_millis" : 1202
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 37,
"size_in_bytes" : 92011
},
"total" : {
"file_count" : 37,
"size_in_bytes" : 92011
},
"start_time_in_millis" : 1690270655933,
"time_in_millis" : 1202
}
}
}
},
".ds-.monitoring-es-8-mb-2023.07.23-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 157,
"size_in_bytes" : 416973340
},
"total" : {
"file_count" : 157,
"size_in_bytes" : 416973340
},
"start_time_in_millis" : 1690270655680,
"time_in_millis" : 23036
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 157,
"size_in_bytes" : 416973340
},
"total" : {
"file_count" : 157,
"size_in_bytes" : 416973340
},
"start_time_in_millis" : 1690270655680,
"time_in_millis" : 23036
}
}
}
},
".internal.alerts-observability.uptime.alerts-default-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270654933,
"time_in_millis" : 200
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270654933,
"time_in_millis" : 200
}
}
}
},
".fleet-file-data-agent-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655333,
"time_in_millis" : 200
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655333,
"time_in_millis" : 200
}
}
}
},
".apm-agent-configuration" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 200
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 200
}
}
}
},
".apm-source-map" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655933,
"time_in_millis" : 201
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655933,
"time_in_millis" : 201
}
}
}
},
".kibana-event-log-8.8.2-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 7,
"size_in_bytes" : 14177
},
"total" : {
"file_count" : 7,
"size_in_bytes" : 14177
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 801
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 7,
"size_in_bytes" : 14177
},
"total" : {
"file_count" : 7,
"size_in_bytes" : 14177
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 801
}
}
}
},
".ds-ilm-history-5-2023.07.23-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 13,
"size_in_bytes" : 43466
},
"total" : {
"file_count" : 13,
"size_in_bytes" : 43466
},
"start_time_in_millis" : 1690270655933,
"time_in_millis" : 401
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 13,
"size_in_bytes" : 43466
},
"total" : {
"file_count" : 13,
"size_in_bytes" : 43466
},
"start_time_in_millis" : 1690270655933,
"time_in_millis" : 401
}
}
}
},
".fleet-files-agent-000001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655933,
"time_in_millis" : 201
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 247
},
"start_time_in_millis" : 1690270655933,
"time_in_millis" : 201
}
}
}
},
".kibana_analytics_8.8.2_001" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 16,
"size_in_bytes" : 2522785
},
"total" : {
"file_count" : 16,
"size_in_bytes" : 2522785
},
"start_time_in_millis" : 1690270655480,
"time_in_millis" : 15230
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 16,
"size_in_bytes" : 2522785
},
"total" : {
"file_count" : 16,
"size_in_bytes" : 2522785
},
"start_time_in_millis" : 1690270655480,
"time_in_millis" : 15230
}
}
}
},
".security-7" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 31,
"size_in_bytes" : 459868
},
"total" : {
"file_count" : 31,
"size_in_bytes" : 459868
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 2002
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 31,
"size_in_bytes" : 459868
},
"total" : {
"file_count" : 31,
"size_in_bytes" : 459868
},
"start_time_in_millis" : 1690270655133,
"time_in_millis" : 2002
}
}
}
},
".async-search" : {
"shards_stats" : {
"initializing" : 0,
"started" : 0,
"finalizing" : 0,
"done" : 1,
"failed" : 0,
"total" : 1
},
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 248
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 248
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 0
},
"shards" : {
"0" : {
"stage" : "DONE",
"stats" : {
"incremental" : {
"file_count" : 1,
"size_in_bytes" : 248
},
"total" : {
"file_count" : 1,
"size_in_bytes" : 248
},
"start_time_in_millis" : 1690270655080,
"time_in_millis" : 0
}
}
}
}
}
}
]
}
Inspect snapshots.
$ curl -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch/*?verbose=false&pretty"
{
"snapshots" : [
{
"snapshot" : "snapshot-202307250737",
"uuid" : "vRcmnfIaQKmBdN6nAB99Mg",
"repository" : "srv-elasticsearch",
"indices" : [
".kibana_8.8.2_001",
".fleet-files-agent-000001",
".security-7",
".apm-agent-configuration",
".kibana_alerting_cases_8.8.2_001",
".internal.alerts-observability.metrics.alerts-default-000001",
".ds-.monitoring-es-8-mb-2023.07.23-000001",
".kibana_security_solution_8.8.2_001",
".internal.alerts-security.alerts-default-000001",
".ds-metricbeat-8.8.2-2023.07.23-000001",
".fleet-file-data-agent-000001",
".internal.alerts-observability.logs.alerts-default-000001",
".internal.alerts-observability.apm.alerts-default-000001",
".kibana_analytics_8.8.2_001",
".kibana_ingest_8.8.2_001",
".apm-custom-link",
".apm-source-map",
".ds-.logs-deprecation.elasticsearch-default-2023.07.23-000001",
".async-search",
".kibana_security_session_1",
".ds-ilm-history-5-2023.07.23-000001",
".internal.alerts-observability.slo.alerts-default-000001",
".internal.alerts-observability.uptime.alerts-default-000001",
".kibana_task_manager_8.8.2_001",
".kibana-event-log-8.8.2-000001",
".security-profile-8"
],
"data_streams" : [ ],
"state" : "SUCCESS"
}
],
"total" : 1,
"remaining" : 0
}
Inspect snapshot details.
$ curl -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch/snapshot-202307250737?pretty"
{
"snapshots" : [
{
"snapshot" : "snapshot-202307250737",
"uuid" : "vRcmnfIaQKmBdN6nAB99Mg",
"repository" : "srv-elasticsearch",
"version_id" : 8080299,
"version" : "8.8.2",
"indices" : [
".security-7",
".fleet-files-agent-000001",
".internal.alerts-observability.uptime.alerts-default-000001",
".internal.alerts-observability.logs.alerts-default-000001",
".ds-ilm-history-5-2023.07.23-000001",
".ds-metricbeat-8.8.2-2023.07.23-000001",
".ds-.logs-deprecation.elasticsearch-default-2023.07.23-000001",
".ds-.monitoring-es-8-mb-2023.07.23-000001",
".kibana_security_solution_8.8.2_001",
".kibana_ingest_8.8.2_001",
".internal.alerts-observability.apm.alerts-default-000001",
".kibana_alerting_cases_8.8.2_001",
".fleet-file-data-agent-000001",
".internal.alerts-observability.metrics.alerts-default-000001",
".security-profile-8",
".async-search",
".kibana_analytics_8.8.2_001",
".internal.alerts-security.alerts-default-000001",
".apm-source-map",
".kibana_security_session_1",
".apm-agent-configuration",
".kibana_8.8.2_001",
".kibana-event-log-8.8.2-000001",
".internal.alerts-observability.slo.alerts-default-000001",
".apm-custom-link",
".kibana_task_manager_8.8.2_001"
],
"data_streams" : [
"ilm-history-5",
".logs-deprecation.elasticsearch-default",
"metricbeat-8.8.2",
".monitoring-es-8-mb"
],
"include_global_state" : true,
"state" : "SUCCESS",
"start_time" : "2023-07-25T07:37:34.933Z",
"start_time_in_millis" : 1690270654933,
"end_time" : "2023-07-25T07:38:03.154Z",
"end_time_in_millis" : 1690270683154,
"duration_in_millis" : 28221,
"failures" : [ ],
"shards" : {
"total" : 26,
"failed" : 0,
"successful" : 26
},
"feature_states" : [
{
"feature_name" : "async_search",
"indices" : [
".async-search"
]
},
{
"feature_name" : "security",
"indices" : [
".security-7",
".security-profile-8"
]
},
{
"feature_name" : "kibana",
"indices" : [
".kibana_security_solution_8.8.2_001",
".kibana_task_manager_8.8.2_001",
".apm-custom-link",
".apm-agent-configuration",
".kibana_security_session_1",
".kibana_8.8.2_001",
".kibana_alerting_cases_8.8.2_001",
".kibana_ingest_8.8.2_001",
".kibana_analytics_8.8.2_001"
]
}
]
}
],
"total" : 1,
"remaining" : 0
}
Delete an index.
$ curl -X DELETE -u elastic:************ "https://192.168.8.153:9200/.apm-source-map?pretty"
{
"acknowledged" : true
}
Recover index from snapshot. Notice, you can use this parameter earlier to create snapshot for selected indices only.
$ curl -X POST -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch/snapshot-202307250737/_restore?pretty" \
-H 'Content-Type: application/json' -d'{ "indices": ".apm-source-map"}'
{
"accepted" : true
}
Inspect recovered index.
$ curl -u elastic:************ "https://192.168.8.153:9200/.apm-source-map?pretty"
{
".apm-source-map" : {
"aliases" : { },
"mappings" : {
"dynamic" : "strict",
"properties" : {
"content" : {
"type" : "binary"
},
"content_sha256" : {
"type" : "keyword"
},
"created" : {
"type" : "date"
},
"file" : {
"properties" : {
"path" : {
"type" : "keyword"
}
}
},
"fleet_id" : {
"type" : "keyword"
},
"service" : {
"properties" : {
"name" : {
"type" : "keyword"
},
"version" : {
"type" : "keyword"
}
}
}
}
},
"settings" : {
"index" : {
"routing" : {
"allocation" : {
"include" : {
"_tier_preference" : "data_content"
}
}
},
"hidden" : "true",
"number_of_shards" : "1",
"auto_expand_replicas" : "0-2",
"provided_name" : ".apm-source-map",
"creation_date" : "1690145384564",
"number_of_replicas" : "2",
"uuid" : "qzu3Lab-SgKyPjwRYAkpuw",
"version" : {
"created" : "8080299"
}
}
}
}
}
Cleanup repostitory to remove unreferenced data.
$ curl -X POST -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch/_cleanup?pretty"
{
"results" : {
"deleted_bytes" : 0,
"deleted_blobs" : 0
}
}
Remove snapshot.
$ curl -X DELETE -u elastic:************ "https://192.168.8.153:9200/_snapshot/srv-elasticsearch/snapshot-202307250737?pretty"
{
"acknowledged" : true
}
Additional notes
