#建立資料夾用作Elasticsearch備份倉庫：
mkdir /usr/local/suninfo/siem/backup
#賦許可權
chmod 777 /usr/local/suninfo/siem/backup


在elasticsearch.yml檔案中增加path.repo路徑配置：


$ vim /usr/local/suninfo/siem/elasticsearch/config/elasticsearch.yml
加上這個配置：
path.repo: ["/usr/local/suninfo/siem/backup"]


重啟elasticsearch






#----------------------------------建立倉庫------------------------------------------
curl -XPUT 'http://192.168.211.50:9200/_snapshot/my_backup' -d '{
    "type": "fs",
    "settings": {
"compress" : "true",
        "location": "/usr/local/suninfo/siem/backup/my_backup"
    }
}'
#----------------------------------檢視倉庫------------------------------------------
curl -XGET 'http://192.168.211.50:9200/_snapshot/my_backup?pretty'




#----------------------------------備份索引------------------------------------------
curl -XPUT 'http://192.168.211.50:9200/_snapshot/my_backup/snapshot_1'    // 備份所有


curl -XPUT 'http://192.168.211.50:9200/_snapshot/my_backup/snapshot_1' -d '{
    "indices": "users",
    "ignore_unavailable": "true",
    "include_global_state": false,
    "partial": "false"
}'


#----------------------------------檢視備份------------------------------------------
curl -XGET 'http://127.0.0.1:9200/_snapshot/my_backup/snapshot_1'
curl -XGET 'http://127.0.0.1:9200/_snapshot/my_backup/snapshot_1/_status'






#----------------------------------恢復索引------------------------------------------
curl -XPOST 'http://192.168.211.50:9200/_snapshot/my_backup/snapshot_1/_restore' -d '{
    "indices": "users",
    "ignore_unavailable": "true",
    "include_global_state": false,
    "rename_pattern": "index_(.+)",
    "rename_replacement": "restored_index_$1"
}'




#----------------------------------刪除備份------------------------------------------
curl -XDELETE 'http://127.0.0.1:9200/_snapshot/my_backup/snapshot_1'