How to export and import Elasticsearch backup?

Graylog Central (peer support)
1

Hi,

I’m trying to import an Elasticsearch dump generated in my old VM (Ubuntu 16 + Graylog 3.3.11+9335407) to my new VM (Ubuntu 20 + Graylog 4.2.7+879e651). But even after conclude the export and import steps Graylog can’t find the Elasticsearch data.

Those are the steps I followed:

Backup

  1. I registered a snapshot repository in VM containing Graylog 3.3.11+9335407
curl -X PUT "localhost:9200/_snapshot/graylog_backup?pretty" -H 'Content-Type: application/json' -d'
{
  "type": "fs",
  "settings": {
    "location": "/var/backups/elasticsearch/"
  }
}
'
  1. Then I created the snapshot
curl -X PUT "localhost:9200/_snapshot/graylog_backup/snapshot_20220307?wait_for_completion=true&pretty"
  1. And last all of /var/backups/elasticsearch/ directory content was archived (using tar) and sent to the new server (Graylog 4.2.7+879e651):
cd /var/backups/elasticsearch/
tar fczP elasticsearch-07032022.tar.gz *

scp -P 60022 /var/backups/elasticsearch/elasticsearch-07032022.tar.gz tomasi@N.N.N.N:/home/tomasi/

Restore

In the new server I followed those steps:

  1. I registered a snapshot repository

  2. Then I moved the .tar.gz file to /var/backups/elasticsearch/ directory and extracted it:

cd /var/backups/elasticsearch/
mv /home/tomasi/elasticsearch-07032022.tar.gz .
tar -xvf elasticsearch-07032022.tar.gz
  1. And last I imported the snapshot in the new server:
curl -X POST "localhost:9200/_snapshot/graylog_backup/snapshot_20220307/_restore?pretty"
  1. Linux showed a succesful message:
{
  "accepted" : true
}

The new server (Ubuntu 20 + Graylog 4.2.7+879e651) detected the Elasticsearch data (5.5GiB)

image
image820×227 19.3 KB

But I can’t search inside that data (for example the last 7 days):

image
image1344×302 19.5 KB

Do you have suggestions about what to do next step?

Thank you

2

Hello @tomasi

Perhaps this post may help

3

I don’t know how it happened, but it’s working now:

I opened the Default index set and clicked on Maintenance > Recalculate index ranges

Now Graylog 4.2.7+879e651 detected the last indexes (graylog_34, graylog_35 and graylog_36) that were being used in Graylog 3.3.11+9335407 VM:

image
image1366×725 78.5 KB

And it started storing/searching syslogs again.

image
image1920×374 33.7 KB

The number of documents is increasing in graylog_36 index as expected.

Thanks!

4

Nice, glad you resolved this issue, If you could mark this as resolved that would be great for future search for community members with the same problem :smiley:

5

thanks for the awesome information.