Back Up and Restore Elasticsearch Snapshots

Use the existing Elasticsearch snapshot from your source Virtual Appliance to perform a backup and restore operation on the destination Virtual Appliance. Snapshots include the state of the cluster or the indices at the specific time. These snapshots are incremental in nature it stores the data that are changed from the last snapshot time. You can restore the entire snapshot or only selected indices.

Back Up a Elasticsearch Snapshot

Back up the Elasticsearch data on your source Virtual Appliance by creating a Elasticsearch snapshot.
  1. Create a repo in the NFS server.
    CODE 
    appdcli run es_backup create-fs-repo <repo-name>
    Example:
    CODE 
    appdcli run es_backup create-fs-repo demo
    To view the repositories created for Elasticsearch snapshots, run the following command:
    CODE 
    appdcli run es_backup list-repo
    Sample Output:
    JSON 
    {
  "demo": {
    "type": "fs",
    "uuid": "oFUaRxJwRGS7lkdWldypdA",
    "settings": {
      "location": "/snapshots"
    }
  }
}
  2. Create an Elastisearch snapshot:
    CODE 
    appdcli run es_backup create-snapshot <repo_name> <snapshot_name>

    Example

    CODE 
    appdcli run es_backup create-snapshot demo demo-snapshot
    Sample Output:
    JSON 
    {
    {
      "snapshot": "demo-snapshot",
      "uuid": "E5IIr16dQ7a92xo5Ik49AQ",
      "repository": "demo",
      "version_id": 8536000,
      "version": "8.19.0-8.19.5",
      "indices": [
        "async_executor_status",
        "job_framework_job_histories_v1",
        "event_type_extracted_fields",
        "customer1_30af45dd-4bb9-4700-aa4d-1e56e3b09ee7___log_v1___2025-10-29_17-22-12",
        "appdynamics_accounts_v2",
        "slm_performance_configs_v2",
        "appdynamics_version",
        "event_type_metadata",
        "appdynamics_metadata_entities_v1",
        "job_framework_triggers_v1",
        "biz_outcome_definitions",
        ".ds-.logs-deprecation.elasticsearch-default-2025.10.29-000001",
        "appdynamics_meters_v4",
        "scheduled_funnel_configs_v1",
        "appdynamics_api_keys_v1",
        "job_framework_job_details_v1",
        ".ds-ilm-history-7-2025.10.29-000001",
        "event_type_metadata_hidden_fields_v1"
      ],
      "data_streams": [
        ".logs-deprecation.elasticsearch-default",
        "ilm-history-7"
      ],
      "include_global_state": false,
      "state": "SUCCESS",
      "start_time": "2025-10-30T13:35:30.307Z",
      "start_time_in_millis": 1761831330307,
      "end_time": "2025-10-30T13:35:31.907Z",
      "end_time_in_millis": 1761831331907,
      "duration_in_millis": 1600,
      "failures": [],
      "shards": {
        "total": 27,
        "failed": 0,
        "successful": 27
      },
      "feature_states": []
    }
  ],
  "total": 3,
  "remaining": 0
}
  3. Log in to NFS server and view the indices of the Elasticsearch snapshot:
    CODE 
    ls -ltr es-es-backup-pvc-pvc-a279f1d5-9a43-465d-a382-4e9014a7b58c
    Sample Output:
    CODE 
    -rw-r--r--  1 appduser appduser    8 Oct 31 14:18 index.latest
-rw-r--r--  1 appduser appduser 6360 Oct 31 14:18 index-0
-rw-r--r--  1 appduser appduser  821 Oct 31 14:18 snap-3rZdiMYOQNuZ_JCYX1pzLw.dat
-rw-r--r--  1 appduser appduser  595 Oct 31 14:18 meta-3rZdiMYOQNuZ_JCYX1pzLw.dat
drwxr-xr-x 21 appduser appduser 4096 Oct 31 14:18 indices

Restore an Elasticsearch Snapshot

Restore the Elasticsearch snapshot on the destination Virtual Appliance:
  1. Log in to the destination Virtual Appliance and create repo and snapshot with the same name that you have created in the source Virtual Appliance:
    1. Create a repo in the NFS server.
      CODE 
      appdcli run es_backup create-fs-repo <repo-name>
      Example:
      CODE 
      appdcli run es_backup create-fs-repo demo
      To view the repositories created for Elasticsearch snapshots, run the following command:
      CODE 
      appdcli run es_backup list-repo
      Sample Output:
      JSON 
      {
  "demo": {
    "type": "fs",
    "uuid": "oFUaRxJwRGS7lkdWldypdA",
    "settings": {
      "location": "/snapshots"
    }
  }
}
    2. Create an Elastisearch snapshot using the following command:
      CODE 
      appdcli run es_backup create-snapshot <repo_name> <snapshot_name>

      Example

      CODE 
      appdcli run es_backup create-snapshot demo demo-snapshot
      Sample Output:
      JSON 
      {
    {
      "snapshot": "demo-snapshot",
      "uuid": "E5IIr16dQ7a92xo5Ik49AQ",
      "repository": "demo",
      "version_id": 8536000,
      "version": "8.19.0-8.19.5",
      "indices": [
        "async_executor_status",
        "job_framework_job_histories_v1",
        "event_type_extracted_fields",
        "customer1_30af45dd-4bb9-4700-aa4d-1e56e3b09ee7___log_v1___2025-10-29_17-22-12",
        "appdynamics_accounts_v2",
        "slm_performance_configs_v2",
        "appdynamics_version",
        "event_type_metadata",
        "appdynamics_metadata_entities_v1",
        "job_framework_triggers_v1",
        "biz_outcome_definitions",
        ".ds-.logs-deprecation.elasticsearch-default-2025.10.29-000001",
        "appdynamics_meters_v4",
        "scheduled_funnel_configs_v1",
        "appdynamics_api_keys_v1",
        "job_framework_job_details_v1",
        ".ds-ilm-history-7-2025.10.29-000001",
        "event_type_metadata_hidden_fields_v1"
      ],
      "data_streams": [
        ".logs-deprecation.elasticsearch-default",
        "ilm-history-7"
      ],
      "include_global_state": false,
      "state": "SUCCESS",
      "start_time": "2025-10-30T13:35:30.307Z",
      "start_time_in_millis": 1761831330307,
      "end_time": "2025-10-30T13:35:31.907Z",
      "end_time_in_millis": 1761831331907,
      "duration_in_millis": 1600,
      "failures": [],
      "shards": {
        "total": 27,
        "failed": 0,
        "successful": 27
      },
      "feature_states": []
    }
  ],
  "total": 3,
  "remaining": 0
}
  2. Log in to the NFS server and copy the source Virtual Appliance backup file contents to destination Virtual Appliance.
    CODE 
    cp -r <Backup-of-Elasticsearch-Folder-Source-VA>/* <Backup-of-Elasticsearch-Folder-Destination-VA>
    1. Update the owner permissions for the backup folder:
      CODE 
      sudo chown -R 1000:1000 <Backup-of-Elasticsearch-Folder-Destination-VA>
    2. Verify whether the file contents are same in both source and destination Virtual Appliance.
  3. Log in to the destination Virtual Appliance and:
    1. Start the services:
      CODE 
      appdcli start appd <profile>
    2. Verify the MySQL restoration:
      Sample Output:
      CODE 
      NAME READY STATUS RESTARTS AGE
appd-es-node-0 1/1 Running 0 17m
appd-es-node-1 1/1 Running 0 17m
appd-es-node-2 1/1 Running 0 17m
es-shell-0 1/1 Running 0 18m
es-shell-1 1/1 Running 0 17m
es-shell-2 1/1 Running 0 17m
Note: After restoring Elasticsearch indices on the destination Virtual Appliance, the Controller UI will display the data from that Virtual Appliance. Log in to the Controller UI to verify that it displays the correct data.

Once the destination Virtual Appliance is ready, redirect the traffic from the source Virtual Appliance to this destination Virtual Appliance.