Back Up and Restore Elasticsearch Snapshots

Use the existing Elasticsearch snapshot from your source Virtual Appliance to perform a backup and restore operation on the destination Virtual Appliance. Snapshots include the state of the cluster or the indices at the specific time. These snapshots are incremental in nature it stores the data that are changed from the last snapshot time. You can restore the entire snapshot or only selected indices.

Back Up a Elasticsearch Snapshot

Back up the Elasticsearch data on your source Virtual Appliance by creating a Elasticsearch snapshot.
  1. Create a repo in the NFS server.
    appdcli run es_backup create-fs-repo <repo-name>
    Example:
    appdcli run es_backup create-fs-repo demo
    To view the repositories created for Elasticsearch snapshots, run the following command:
    appdcli run es_backup list-repo
    Sample Output:
    {
  "demo": {
    "type": "fs",
    "uuid": "oFUaRxJwRGS7lkdWldypdA",
    "settings": {
      "location": "/snapshots"
    }
  }
}
  2. Create an Elastisearch snapshot using the following command:
    appdcli run es_backup create-snapshot <repo_name> <snapshot_name>

    Example

    appdcli run es_backup create-snapshot demo demo-snapshot
    Sample Output:
    {
    {
      "snapshot": "demo-snapshot",
      "uuid": "E5IIr16dQ7a92xo5Ik49AQ",
      "repository": "demo",
      "version_id": 8536000,
      "version": "8.19.0-8.19.5",
      "indices": [
        "async_executor_status",
        "job_framework_job_histories_v1",
        "event_type_extracted_fields",
        "customer1_30af45dd-4bb9-4700-aa4d-1e56e3b09ee7___log_v1___2025-10-29_17-22-12",
        "appdynamics_accounts_v2",
        "slm_performance_configs_v2",
        "appdynamics_version",
        "event_type_metadata",
        "appdynamics_metadata_entities_v1",
        "job_framework_triggers_v1",
        "biz_outcome_definitions",
        ".ds-.logs-deprecation.elasticsearch-default-2025.10.29-000001",
        "appdynamics_meters_v4",
        "scheduled_funnel_configs_v1",
        "appdynamics_api_keys_v1",
        "job_framework_job_details_v1",
        ".ds-ilm-history-7-2025.10.29-000001",
        "event_type_metadata_hidden_fields_v1"
      ],
      "data_streams": [
        ".logs-deprecation.elasticsearch-default",
        "ilm-history-7"
      ],
      "include_global_state": false,
      "state": "SUCCESS",
      "start_time": "2025-10-30T13:35:30.307Z",
      "start_time_in_millis": 1761831330307,
      "end_time": "2025-10-30T13:35:31.907Z",
      "end_time_in_millis": 1761831331907,
      "duration_in_millis": 1600,
      "failures": [],
      "shards": {
        "total": 27,
        "failed": 0,
        "successful": 27
      },
      "feature_states": []
    }
  ],
  "total": 3,
  "remaining": 0
}
  3. Log in to NFS server and view the indices of the Elasticsearch snapshot using the following command:
     ls -ltr es-es-backup-pvc-pvc-a279f1d5-9a43-465d-a382-4e9014a7b58c
    Sample Output:
    -rw-r--r--  1 appduser appduser    8 Oct 31 14:18 index.latest
-rw-r--r--  1 appduser appduser 6360 Oct 31 14:18 index-0
-rw-r--r--  1 appduser appduser  821 Oct 31 14:18 snap-3rZdiMYOQNuZ_JCYX1pzLw.dat
-rw-r--r--  1 appduser appduser  595 Oct 31 14:18 meta-3rZdiMYOQNuZ_JCYX1pzLw.dat
drwxr-xr-x 21 appduser appduser 4096 Oct 31 14:18 indices

Restore an Elasticsearch Snapshot

Restore the Elasticsearch snapshot on the destination Virtual Appliance:
  1. Log in to the destination Virtual Appliance and create repo and snapshot with the same name that you have created in the source Virtual Appliance:
    1. Create a repo in the NFS server.
      appdcli run es_backup create-fs-repo <repo-name>
      Example:
      appdcli run es_backup create-fs-repo demo
      To view the repositories created for Elasticsearch snapshots, run the following command:
      appdcli run es_backup list-repo
      Sample Output:
      {
  "demo": {
    "type": "fs",
    "uuid": "oFUaRxJwRGS7lkdWldypdA",
    "settings": {
      "location": "/snapshots"
    }
  }
}
    2. Create an Elastisearch snapshot using the following command:
      appdcli run es_backup create-snapshot <repo_name> <snapshot_name>

      Example

      appdcli run es_backup create-snapshot demo demo-snapshot
      Sample Output:
      {
    {
      "snapshot": "demo-snapshot",
      "uuid": "E5IIr16dQ7a92xo5Ik49AQ",
      "repository": "demo",
      "version_id": 8536000,
      "version": "8.19.0-8.19.5",
      "indices": [
        "async_executor_status",
        "job_framework_job_histories_v1",
        "event_type_extracted_fields",
        "customer1_30af45dd-4bb9-4700-aa4d-1e56e3b09ee7___log_v1___2025-10-29_17-22-12",
        "appdynamics_accounts_v2",
        "slm_performance_configs_v2",
        "appdynamics_version",
        "event_type_metadata",
        "appdynamics_metadata_entities_v1",
        "job_framework_triggers_v1",
        "biz_outcome_definitions",
        ".ds-.logs-deprecation.elasticsearch-default-2025.10.29-000001",
        "appdynamics_meters_v4",
        "scheduled_funnel_configs_v1",
        "appdynamics_api_keys_v1",
        "job_framework_job_details_v1",
        ".ds-ilm-history-7-2025.10.29-000001",
        "event_type_metadata_hidden_fields_v1"
      ],
      "data_streams": [
        ".logs-deprecation.elasticsearch-default",
        "ilm-history-7"
      ],
      "include_global_state": false,
      "state": "SUCCESS",
      "start_time": "2025-10-30T13:35:30.307Z",
      "start_time_in_millis": 1761831330307,
      "end_time": "2025-10-30T13:35:31.907Z",
      "end_time_in_millis": 1761831331907,
      "duration_in_millis": 1600,
      "failures": [],
      "shards": {
        "total": 27,
        "failed": 0,
        "successful": 27
      },
      "feature_states": []
    }
  ],
  "total": 3,
  "remaining": 0
}
  2. Log in to the NFS server and copy the source Virtual Appliance backup file contents to destination Virtual Appliance.
    cp -r <Backup-of-Elasticsearch-Folder-Source-VA>/* <Backup-of-Elasticsearch-Folder-Destination-VA>
    1. Update the owner permissions for the backup folder:
      sudo chown -R 1000:1000 <Backup-of-Elasticsearch-Folder-Destination-VA>
    2. Verify whether the file contents are same in both source and destination Virtual Appliance.
  3. Log in to the destination Virtual Appliance and do the following:
    1. Start the services by running the below command:
      appdcli start appd <profile>
    2. Verify the MySQL restoration using the following command:
      Sample Output:
      NAME READY STATUS RESTARTS AGE
appd-es-node-0 1/1 Running 0 17m
appd-es-node-1 1/1 Running 0 17m
appd-es-node-2 1/1 Running 0 17m
es-shell-0 1/1 Running 0 18m
es-shell-1 1/1 Running 0 17m
es-shell-2 1/1 Running 0 17m