Restore Elasticsearch from snapshot

info

Before starting the Elasticsearch events restore process, ensure you have installed and configured the Elasticsearch as per the Portal Dedicated install guide in the destination server.

info

Ensure the snapshot directory and contents have been copied from the source server and extracted to the same location in the destination server, in this example /opt/waratek/elasticsearch-backup

Update permissions to ensure the elasticsearchuser owns the snapshot directory:

sudo chown -R elasticsearch:elasticsearch /opt/waratek/elasticsearch-backup

Configure Elasticsearch with the path to the snapshot directory by adding an entry for the path to /etc/elasticsearch/elasticsearch.yml:

path.repo: /opt/waratek/elasticsearch-backup

Restart the Elasticsearch service:

sudo systemctl restart elasticsearch.service

info

The steps below use the Elasticsearch API. User credentials may be required depending on the configured security. The credentials configured within the Portal Dedicated application.properties have sufficient permissions to run all the required tasks below. The examples use portal/Portal1234 as username/password and should be updated or removed as needed. The examples use HTTPS to connect to Elasticsearch, update to HTTP as appropriate.

Using the Elasticsearch API register the snapshot repository specifying the same names and paths as the backup process:

• a repository name: snapshot-repository in the example below
• the repository location: the full path to the directory created above

curl -XPUT -H "Content-Type: application/json" -k -u portal:Portal1234 "https://localhost:9200/_snapshot/snapshot-repository" -d '
{
  "type": "fs",
  "settings": {
    "location": "/opt/waratek/elasticsearch-backup",
    "compress": true
  }
}'

Restore the snapshot by specifying:

• a repository name: same as created in the step above
• a snapshot name: same as the backup process, cluster-snapshot in the example below

curl -X POST -k -u portal:Portal1234 "https://localhost:9200/_snapshot/snapshot-repository/cluster-snapshot/_restore?wait_for_completion=true"

Verify the restored indices:

curl -X GET -k -u portal:Portal1234 "https://localhost:9200/_cat/indices?v"

info

If upgrading Portal Dedicated from versions 4.x or 5.x the event data needs to be migrated, see the “Migrating existing events from earlier versions” section of the Upgrade Guide for more details.

Done

The Elasticsearch data has been successfully restored from the snapshot