How to export and import Elasticsearch backup?


I’m trying to import an Elasticsearch dump generated in my old VM (Ubuntu 16 + Graylog 3.3.11+9335407) to my new VM (Ubuntu 20 + Graylog 4.2.7+879e651). But even after conclude the export and import steps Graylog can’t find the Elasticsearch data.

Those are the steps I followed:


  1. I registered a snapshot repository in VM containing Graylog 3.3.11+9335407
curl -X PUT "localhost:9200/_snapshot/graylog_backup?pretty" -H 'Content-Type: application/json' -d'
  "type": "fs",
  "settings": {
    "location": "/var/backups/elasticsearch/"
  1. Then I created the snapshot
curl -X PUT "localhost:9200/_snapshot/graylog_backup/snapshot_20220307?wait_for_completion=true&pretty"
  1. And last all of /var/backups/elasticsearch/ directory content was archived (using tar) and sent to the new server (Graylog 4.2.7+879e651):
cd /var/backups/elasticsearch/
tar fczP elasticsearch-07032022.tar.gz *

scp -P 60022 /var/backups/elasticsearch/elasticsearch-07032022.tar.gz tomasi@N.N.N.N:/home/tomasi/


In the new server I followed those steps:

  1. I registered a snapshot repository

  2. Then I moved the .tar.gz file to /var/backups/elasticsearch/ directory and extracted it:

cd /var/backups/elasticsearch/
mv /home/tomasi/elasticsearch-07032022.tar.gz .
tar -xvf elasticsearch-07032022.tar.gz
  1. And last I imported the snapshot in the new server:
curl -X POST "localhost:9200/_snapshot/graylog_backup/snapshot_20220307/_restore?pretty"
  1. Linux showed a succesful message:
  "accepted" : true

The new server (Ubuntu 20 + Graylog 4.2.7+879e651) detected the Elasticsearch data (5.5GiB)

But I can’t search inside that data (for example the last 7 days):

Do you have suggestions about what to do next step?

Thank you

Hello @tomasi

Perhaps this post may help

I don’t know how it happened, but it’s working now:

I opened the Default index set and clicked on Maintenance > Recalculate index ranges

Now Graylog 4.2.7+879e651 detected the last indexes (graylog_34, graylog_35 and graylog_36) that were being used in Graylog 3.3.11+9335407 VM:

And it started storing/searching syslogs again.

The number of documents is increasing in graylog_36 index as expected.


1 Like

Nice, glad you resolved this issue, If you could mark this as resolved that would be great for future search for community members with the same problem :smiley:

thanks for the awesome information.

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.