如何在快照中找到 Elasticsearch 索引？

Question

I have an Elasticsearch cluster running on AWS where I have snapshot like this

 {
     "snapshot": "2016-07-13_165430",
     "indices": [
        "analytical-2016-06-15",
        "analytical_2016-06-13",
        "analytical_2016-07-13",
        "operational-2016-06-15",
        "operational_2016-06-13",
        "operational_2016-07-13"
     ],
     "state": "SUCCESS",
     "start_time": "2016-10-10T23:54:33.705Z",
     "start_time_in_millis": 1476143673705,
     "end_time": "2016-10-10T23:54:44.893Z",
     "end_time_in_millis": 1476143684893,
     "duration_in_millis": 11188,
     "failures": [],
     "shards": {
        "total": 30,
        "failed": 0,
        "successful": 30
     }
  },
  {
     "snapshot": "2016-07-13_165546",
     "indices": [
        "analytical-2016-06-15",
        "analytical_2016-06-13",
        "analytical_2016-07-13",
        "operational-2016-06-15",
        "operational_2016-06-13",
        "operational_2016-07-13"
     ],
     "state": "SUCCESS",
     "start_time": "2016-10-10T23:55:48.808Z",
     "start_time_in_millis": 1476143748808,
     "end_time": "2016-10-10T23:55:52.420Z",
     "end_time_in_millis": 1476143752420,
     "duration_in_millis": 3612,
     "failures": [],
     "shards": {
        "total": 30,
        "failed": 0,
        "successful": 30
     }
  }

Now all these indices are running online with some other indices like: "analytical-2016-06-15",
"analytical_2016-06-13",
"analytical_2016-07-13",
"operational-2016-06-15",
"operational_2016-06-13",
"operational_2016-07-13"
"operational_2016-09-13"
....

I need to check if my indices are backed up or not, and if already backed up in which snapshot it exists.

Answer 1

I suspect @air is (was) interested in finding which of many snapshots contain a given index; the pasted example was just one view of snapshot history. When you've been taking daily snapshots over a span of time, and indices have been added/removed, it would be a chore to search manually.

There doesn't seem to be an API invocation for "find me all snapshots containing index operational_2021-06-10 " but here's an automation option:

 curl -XGET "http://cluster:9200/_snapshot/myrepo/*" |
   jq -c '.snapshots[] | select(.indices | index("operational_2021-06-10")) | { snapshot }'

{"snapshot":"daily-snap-2021.06.10-hjmskkjsryyq82asmxiuva"}
{"snapshot":"daily-snap-2021.06.11-eayyiiort0cx97r_jscara"}
{"snapshot":"daily-snap-2021.06.12-rmrsbmsespgf0_czu721hw"}
{"snapshot":"daily-snap-2021.06.13-meeoachori61w5r3n3qzaq"}
{"snapshot":"daily-snap-2021.06.14-espbnhuprcckqylk3xltwq"}
{"snapshot":"daily-snap-2021.06.15-sbosayasthinaudxaqw3pa"}

Answer 2

I'm confused by your question as you have posted snapshot json which tells you exactly which indices are backed up in each snapshot. You need to go through each snapshot each in each snapshot repository (which I think you already know how to do) and look at the indices in each snapshot.

This is the only way AFAIK to determine which indices have been backed up, when and by which snapshots.

Here is the documentation to the snapshot api: https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-snapshots.html