Back Up and Restore Elasticsearch Snapshots

Use the existing Elasticsearch snapshot from your source Virtual Appliance to perform a backup and restore operation on the destination Virtual Appliance. Snapshots include the state of the cluster or the indices at the specific time. These snapshots are incremental in nature it stores the data that are changed from the last snapshot time. You can restore the entire snapshot or only selected indices.

Back Up a Elasticsearch Snapshot

Back up the Elasticsearch data on your source Virtual Appliance by creating a Elasticsearch snapshot.

Create a repo in the NFS server.

appdcli run es_backup create-fs-repo <repo-name>

Example:

appdcli run es_backup create-fs-repo demo

To view the repositories created for Elasticsearch snapshots, run the following command:

appdcli run es_backup list-repo

Sample Output:

{
  "demo": {
    "type": "fs",
    "uuid": "oFUaRxJwRGS7lkdWldypdA",
    "settings": {
      "location": "/snapshots"
    }
  }
}

Create an Elastisearch snapshot:

appdcli run es_backup create-snapshot <repo_name> <snapshot_name>

Example

appdcli run es_backup create-snapshot demo demo-snapshot

Sample Output:

{
    {
      "snapshot": "demo-snapshot",
      "uuid": "E5IIr16dQ7a92xo5Ik49AQ",
      "repository": "demo",
      "version_id": 8536000,
      "version": "8.19.0-8.19.5",
      "indices": [
        "async_executor_status",
        "job_framework_job_histories_v1",
        "event_type_extracted_fields",
        "customer1_30af45dd-4bb9-4700-aa4d-1e56e3b09ee7___log_v1___2025-10-29_17-22-12",
        "appdynamics_accounts_v2",
        "slm_performance_configs_v2",
        "appdynamics_version",
        "event_type_metadata",
        "appdynamics_metadata_entities_v1",
        "job_framework_triggers_v1",
        "biz_outcome_definitions",
        ".ds-.logs-deprecation.elasticsearch-default-2025.10.29-000001",
        "appdynamics_meters_v4",
        "scheduled_funnel_configs_v1",
        "appdynamics_api_keys_v1",
        "job_framework_job_details_v1",
        ".ds-ilm-history-7-2025.10.29-000001",
        "event_type_metadata_hidden_fields_v1"
      ],
      "data_streams": [
        ".logs-deprecation.elasticsearch-default",
        "ilm-history-7"
      ],
      "include_global_state": false,
      "state": "SUCCESS",
      "start_time": "2025-10-30T13:35:30.307Z",
      "start_time_in_millis": 1761831330307,
      "end_time": "2025-10-30T13:35:31.907Z",
      "end_time_in_millis": 1761831331907,
      "duration_in_millis": 1600,
      "failures": [],
      "shards": {
        "total": 27,
        "failed": 0,
        "successful": 27
      },
      "feature_states": []
    }
  ],
  "total": 3,
  "remaining": 0
}

 ls -ltr es-es-backup-pvc-pvc-a279f1d5-9a43-465d-a382-4e9014a7b58c

Sample Output:

-rw-r--r--  1 appduser appduser    8 Oct 31 14:18 index.latest
-rw-r--r--  1 appduser appduser 6360 Oct 31 14:18 index-0
-rw-r--r--  1 appduser appduser  821 Oct 31 14:18 snap-3rZdiMYOQNuZ_JCYX1pzLw.dat
-rw-r--r--  1 appduser appduser  595 Oct 31 14:18 meta-3rZdiMYOQNuZ_JCYX1pzLw.dat
drwxr-xr-x 21 appduser appduser 4096 Oct 31 14:18 indices

Restore an Elasticsearch Snapshot

Restore the Elasticsearch snapshot on the destination Virtual Appliance:

Log in to the destination Virtual Appliance and create repo and snapshot with the same name that you have created in the source Virtual Appliance:

Create a repo in the NFS server.

appdcli run es_backup create-fs-repo <repo-name>

Example:

appdcli run es_backup create-fs-repo demo

To view the repositories created for Elasticsearch snapshots, run the following command:

appdcli run es_backup list-repo

Sample Output:

{
  "demo": {
    "type": "fs",
    "uuid": "oFUaRxJwRGS7lkdWldypdA",
    "settings": {
      "location": "/snapshots"
    }
  }
}

Create an Elastisearch snapshot using the following command:

appdcli run es_backup create-snapshot <repo_name> <snapshot_name>

Example

appdcli run es_backup create-snapshot demo demo-snapshot

Sample Output:

{
    {
      "snapshot": "demo-snapshot",
      "uuid": "E5IIr16dQ7a92xo5Ik49AQ",
      "repository": "demo",
      "version_id": 8536000,
      "version": "8.19.0-8.19.5",
      "indices": [
        "async_executor_status",
        "job_framework_job_histories_v1",
        "event_type_extracted_fields",
        "customer1_30af45dd-4bb9-4700-aa4d-1e56e3b09ee7___log_v1___2025-10-29_17-22-12",
        "appdynamics_accounts_v2",
        "slm_performance_configs_v2",
        "appdynamics_version",
        "event_type_metadata",
        "appdynamics_metadata_entities_v1",
        "job_framework_triggers_v1",
        "biz_outcome_definitions",
        ".ds-.logs-deprecation.elasticsearch-default-2025.10.29-000001",
        "appdynamics_meters_v4",
        "scheduled_funnel_configs_v1",
        "appdynamics_api_keys_v1",
        "job_framework_job_details_v1",
        ".ds-ilm-history-7-2025.10.29-000001",
        "event_type_metadata_hidden_fields_v1"
      ],
      "data_streams": [
        ".logs-deprecation.elasticsearch-default",
        "ilm-history-7"
      ],
      "include_global_state": false,
      "state": "SUCCESS",
      "start_time": "2025-10-30T13:35:30.307Z",
      "start_time_in_millis": 1761831330307,
      "end_time": "2025-10-30T13:35:31.907Z",
      "end_time_in_millis": 1761831331907,
      "duration_in_millis": 1600,
      "failures": [],
      "shards": {
        "total": 27,
        "failed": 0,
        "successful": 27
      },
      "feature_states": []
    }
  ],
  "total": 3,
  "remaining": 0
}

Log in to the NFS server and copy the source Virtual Appliance backup file contents to destination Virtual Appliance.
```
cp -r <Backup-of-Elasticsearch-Folder-Source-VA>/* <Backup-of-Elasticsearch-Folder-Destination-VA>
```
1. Update the owner permissions for the backup folder:
```
sudo chown -R 1000:1000 <Backup-of-Elasticsearch-Folder-Destination-VA>
```
2. Verify whether the file contents are same in both source and destination Virtual Appliance.

Start the services:
```
appdcli start appd <profile>
```

Verify the MySQL restoration:

Sample Output:

NAME READY STATUS RESTARTS AGE
appd-es-node-0 1/1 Running 0 17m
appd-es-node-1 1/1 Running 0 17m
appd-es-node-2 1/1 Running 0 17m
es-shell-0 1/1 Running 0 18m
es-shell-1 1/1 Running 0 17m
es-shell-2 1/1 Running 0 17m

Note: After restoring Elasticsearch indices on the destination Virtual Appliance, the Controller UI will display the data from that Virtual Appliance. Log in to the Controller UI to verify that it displays the correct data.

Once the destination Virtual Appliance is ready, redirect the traffic from the source Virtual Appliance to this destination Virtual Appliance.