The following instructions in this article are not covered by WhatsUp Gold Technical Support as they are "Out of the Scope of Support"

If you are having issues with these steps you will need to reach out to Elasticsearch Support, Elasticsearch Forums or the WhatsUp Gold Community Forums.


Although Elasticsearch is resilient, it's still a good idea to store a backup of the Log Management indexes somewhere just in case something truly catastrophic happens.

These steps have been tested to work on the following version of Elasticsearch with WUG.

• Elasticsearch 7.6.1
• Elasticsearch 7.16.3
• Elasticsearch 7.17.9

To restore a snapshot, please go to the following article:

Restore Log Management Indexes in Elasticsearch Using Snapshots
 

Preparation

While Elasticsearch is resilient, it's still a good idea to store a backup of the Log Management indexes somewhere just in case something truly catastrophic happens. The following points highlight how Elasticsearch implements the backing up of indexes:

• Backup of indexes are done using snapshots.
• A snapshot is a backup taken from a running Elasticsearch cluster.
• You can take snapshots of individual indices or of the entire cluster.
• Snapshots can be stored in either local or remote repositories.
• Remote repositories can reside on:
  1. File System Shares,
     • Note: This article focus on local and file system share repositories
  2. S3,
  3. HDFS,
  4. Azure,
  5. Google Cloud Storage,
  6. and other platforms supported by a repository plugin.
• Snapshots are incremental:
  1. each snapshot of an index only stores data that is not part of an earlier snapshot.
  2. This enables you to take frequent snapshots with minimal overhead.

Pre-requisites

• Minimum version Kibana version 7.6.1-oss
• Microsoft Windows PowerShell Version 5.1 or greater

• fig Direct: File Directory

• fig YML: Paths in elasticsearch.yml

• Remember: to properly escape backslashes for Windows absolute and UNC paths.
• Remember: to give read+write permissions on this repo directory, to the user account under which Elasticsearch is running. See fig Read/Write
• Note: you can specify any legitimate format for the shared path; eg. as a Z: drive, as UNC path beginning with the server \\atlbackup01.
• Note: you can specify multiple repositories.

• fig Repo: Configuration of snapshot repository paths.

• fig Read/Write: the user account under which Elasticsearch is running, defaults to "Local System account" during installation of Log Management plugin.

• Register the repo

PUT _snapshot/wug_lm_fs_backup

{

   "type": "fs",

   "settings": {

      "location": "C:\\lm_backups"

   }

}

• fig API and Response:

• On a share

• fig Share: API and Response on Share

• Open PowerShell in elevated mode
• Define the $Body and $params variables at the PS command prompt (>> means press Enter).
• Invoke the rest method

• fig variable definition:

• fig variable definition; invoke rest method

3. Verify the existence of the newly created repo

Using Kibana, Verify the repo (Show all repos with name prefix wug)

• fig Verify: Verify newly created repo

• Open PowerShell in elevated mode
• Define the $params variable at the PS command prompt (>> means press Enter).

• fig Verify PS: Verify newly created repo using PowerShell  Execute the Invoke-RestMethod using the @params variable

4. Create a snapshot under the new repository

Using Kibana, using the Elasticsearch snapshot API to create a snapshot of every open WUG indexes in the cluster.

• Create the snapshot

# Best practice to use the same name for the snapshot to take advantage of incremental snapshot'ting

# PUT /_snapshot/wug_lm_fs_backup/<wuglogs-snaps>

PUT /_snapshot/wug_lm_fs_backup/%3Cwuglogs-snaps%3E

{

   "indices": "wuglog-*",

   "ignore_unavailable": true

}

# OR

# place on a share

PUT /_snapshot/wug_lm_fs_share_backup/%3Cwuglogs-snaps%3E

{

   "indices": "wuglog-*",

   "ignore_unavailable": true

}

# adding date suffix

# PUT /_snapshot/wug_lm_fs_share_backup/<wuglogs-{now/d}>

PUT /_snapshot/wug_lm_fs_share_backup/%3Cwuglogs-%7Bnow%2Fd%7D%3E

{

   "indices": "wuglog-*",

   "ignore_unavailable": true

}

fig 2.5.1a: API on a registered, local repo

fig 2.5.1b: API and Response, on a share

2.5.2 Using PowerShell, use the Elasticsearch snapshot API to create a repository in the cluster. See fig 2.5.2 

• Open PowerShell in elevated mode
• Define the $Body and $params variables at the PS command prompt (>> means press Enter).
• Invoke the rest method

$Body=

'{

"indices": "wuglog-*",

"ignore_unavailable": "true"

}'

$params = @{

Uri = 'http://localhost:9200/_snapshot/wug_lm_fs_backup/%3Cwuglogs-snaps%3E';

Method = 'PUT'

Body = "$Body"

ContentType = 'application/json'

}

Invoke-RestMethod @params


fig 2.5.2: Set variables and execute in PowerShell

2.6. Verify the existence of the newly created snapshots

2.6.1 Using Kibana, using the Elasticsearch snapshot API, verify that the snapshots were created.

• Verify the snapshots on the share, that have name prefix wug

GET /_snapshot/wug_lm_fs_share_backup/wug*

GET /_snapshot/wug_lm_fs_backup/wuglogs-snaps/_status

• Note: the state of the snapshot is "IN_PROGRESS", fig 2.6.1a.
• Note: When the snapshot is completed, the status will will show "SUCCESS".
• Note: WUG-35239, the actual physical snapshot created in the repo, fig 2.6.1b.

fig 2.6.1a: Verification of snapshot


fig 2.6.1b: the physical snapshot created in the repo.


fig 2.6.1c: get the full status of snapshot, (on the local repo in this case)

2.6.2 Using PowerShell, using the Elasticsearch snapshot API, verify that the snapshots were created. See fig 2.6.1d.

• Open PowerShell in elevated mode
• Define the $params variable at the PS command prompt (>> means press Enter).

$params = @{

Uri = 'http://localhost:9200/_snapshot/wug_lm_fs_share_backup/wug*';

Method = 'GET'

ContentType = 'application/json'

}

• Execute the Invoke-RestMethod using the @params variable

Invoke-RestMethod @params

$params = @{

Uri = 'http://localhost:9200/_snapshot/wug_lm_fs_backup/wuglogs-snaps/_status';

Method = 'GET'

ContentType = 'application/json'

}

• Execute the Invoke-RestMethod using the @params variable

Invoke-RestMethod @params
fig 2.6.1d: Verification of snapshot

2.7 Delete a snapshot

2.7.1 Using Kibana, you can delete a snapshot.

• delete a snapshot from the local repo

DELETE /_snapshot/wug_lm_fs_backup/wuglogs-snaps

fig 2.7.1a: Delete a snapshot


fig 2.7.1b: It's gone