When I try to restore indices from manual snapshots in Amazon Elasticsearch Service, the restoration fails with an error message similar to the following. How do I resolve this?

 cannot restore index [.kibana] because it's 
 cannot restore index [.kibana] because it's open"},"status":500}

In Elasticsearch versions 5.1 and later, Amazon ES monitors the .kibana index and recreates it if it's deleted. This behavior can cause the restoration to fail.  

1.    Run commands similar to the following to rename the .kibana index when you restore the indices. In this example, the .kibana index is renamed to "restored_.kibana".

# restore indices.   
$ curl -XPOST -H 'Content-Type: application/json' 'https://<domain-end-point>/_snapshot/<repository-name>/<snapshot-name>/_restore' -d '
  "indices": "*",
  "ignore_unavailable": true,
  "include_global_state": true,
  "rename_pattern": ".kibana",
  "rename_replacement": "restored_.kibana"

2.    After you restore the indices, use the _reindex API to rename "restored_.kibana" back to ".kibana". Example:

# reindex restored_.kibana to .kibana 
$ curl -XPOST -H 'Content-Type: application/json' 'https://<domain-end-point>/_reindex' -d '
  "source": {
    "index": "restored_.kibana"
  "dest": {
    "index": ".kibana"

You should now be able to restore indices from manual snapshots.

Did this page help you? Yes | No

Back to the AWS Support Knowledge Center

Need help? Visit the AWS Support Center

Published: 2018-08-31