Restore managed indices and manage ILM actions

When restoring a managed Elasticsearch index or data stream, index lifecycle management (ILM) resumes running the associated policies automatically. You can temporarily stop ILM to control the running of lifecycle actions, ensuring restored indices progress through phases according to your operational needs.

To restore managed indices, ensure that the ILM policies referenced by the indices exist. If necessary, you can restore ILM policies by setting include_global_state to true.

A restored index’s min_age is relative to when it was originally created or rolled over, not its restoration time. Policy actions are performed on the same schedule irrespective of whether an index has been restored from a snapshot. If you restore an index that was accidentally deleted half way through its month long lifecycle, it proceeds normally through the last two weeks of its lifecycle.

You might want to prevent ILM from immediately executing its policy on a restored index. For example, if you are restoring an older snapshot you might want to prevent it from rapidly progressing through all its lifecycle phases. You might want to add or update documents before it’s marked read-only or shrunk, or prevent the index from being immediately deleted.

To prevent ILM from executing a restored index’s policy:

In Kibana, go to Data management and select Snapshot and Restore.
From the Snapshots page, select the snapshot you wish to restore and then select the Restore action.
On the Index settings restore page, enable Reset index settings and add the index.lifecycle.name and index.lifecycle.rollover_alias index settings.
Select Next and then select Restore snapshot.

Alternatively, you can use the Restore a snapshot API with the ignore_index_settings option. If you need to re-add the ILM policy, refer to Apply an index lifecycle policy to an existing Elasticsearch index for details.