Introduction
This article outlines the steps to restore a specific index or data stream from a snapshot in Elastic
Prerequisites
You must have a snapshot repository configured within Elastic to utilize this feature. More information regarding that, can be found here:
Elastic Docs | Snapshot and restore
Process
Identify Snapshot:
In Kibana, go to Stack Management > Snapshot and Restore > Snapshots.
Find snapshot with the target index you wish to restore (e.g., .ds-metrics-elastic_agent.filebeat_input-2025.02.12-000033) or check daily snapshots if you don’t see your target index (e.g., daily-snapshot-###).
Restore Index:
When you find the correct snapshot, select Restore.
Configure:
Indices: If you need to restore a single index, make sure you are on ‘Index Patterns’ and enter the index name. You also have the option to restore ALL if needed.
Rename Pattern (Optional): (.+) to restored-$1 for testing.
Uncheck Include Global State, check Partial Restore and Include Aliases.
Click Restore.
Confirm the target index is listed in the Summary → Restore
Confirm Data Recovery:
Locate the index in Index Management and select Discover
