{"id":9678,"date":"2026-01-08T08:52:29","date_gmt":"2026-01-08T03:22:29","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=9678"},"modified":"2026-01-08T08:53:05","modified_gmt":"2026-01-08T03:23:05","slug":"how-to-perform-elk-server-backup-restore-and-recovery-elasticsearch-7-17-x","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/how-to-perform-elk-server-backup-restore-and-recovery-elasticsearch-7-17-x\/","title":{"rendered":"How to Perform ELK Server Backup, Restore, and Recovery (Elasticsearch 7.17.x)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Introduction<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide explains how to restore an ELK (Elasticsearch, Logstash, Kibana) stack from backup in a clean, structured, and production-safe manner.It is designed as a Disaster Recovery (DR) Runbook, suitable for system administrators managing ELK in production environments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Prerequisites<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Ubuntu 20.04 \/ 22.04 server (recommended)<\/li>\n\n\n\n<li>Root or sudo access<\/li>\n\n\n\n<li>Internet access (for package installation)<\/li>\n\n\n\n<li>AWS S3 access (for backup restore)<\/li>\n\n\n\n<li>Same major ELK version (7.17.x)<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Backup Scope<\/strong><br>Included in Backup<br>     1. Elasticsearch data (\/var\/lib\/elasticsearch)<br>     2. Elasticsearch configuration<br>     3. Logstash pipelines &amp; config<br>     4. Kibana configuration<br>     5. Nginx configuration<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Not Included<br>     1. Operating system<br>     2. Installed system packages<br>     3. Java runtime<br>     4. System users and permissions<br>     5. Kernel or OS-level tuning<br><strong>Step 1:<\/strong><br>Update system repositories:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ apt update<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br>Install Java (required for ELK tools):<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ apt install openjdk-11-jdk -y<br>$ java -version<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 2:<\/strong><br>Install Elasticsearch (Same Version)<br>Add Elastic repository:<br><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ wget -qO &#8211; https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | sudo gpg &#8211;dearmor -o \/usr\/share\/keyrings\/elastic-keyring.gpg<br>$ echo &#8220;deb [signed-by=\/usr\/share\/keyrings\/elastic-keyring.gpg] https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main&#8221; | sudo tee \/etc\/apt\/sources.list.d\/elastic-7.x.list<br>$ sudo apt update<br>$ apt install elasticsearch=7.17.0 -y<br>$ \/usr\/share\/elasticsearch\/bin\/elasticsearch &#8211;version<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 3:<\/strong><br>Install Logstash<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ apt install logstash -y<br>$ \/usr\/share\/logstash\/bin\/logstash &#8211;version<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 4:<\/strong><br>Install Kibana<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ apt install kibana -y<br>$ \/usr\/share\/kibana\/bin\/kibana &#8211;version<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 5:<\/strong><br>Stop All Services Before Restore<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ systemctl stop elasticsearch<br>$ systemctl stop logstash<br>$ systemctl stop kibana<br>$ systemctl stop nginx<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 6:<\/strong><br>Restore Backup from S3<br>Install AWS CLI<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ apt install awscli -y<br>$ aws configure<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Download Backup Files<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ mkdir -p \/restore<br>$ aws s3 sync s3:\/\/\/elk-backup\/ \/restore\/<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 7:<\/strong><br>Restore Elasticsearch Data (Critical Step)<br>Backup Empty Directory (Safety)<br><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ mv \/var\/lib\/elasticsearch \/var\/lib\/elasticsearch.empty<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Restore Data<br>Never start Elasticsearch before restoring data.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ cp -a \/restore\/var\/lib\/elasticsearch \/var\/lib\/<br>$ chown -R elasticsearch:elasticsearch \/var\/lib\/elasticsearch<br>$ chmod -R 750 \/var\/lib\/elasticsearch<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 8:<\/strong><br>Restore Configuration Files<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ cp -a \/restore\/etc\/elasticsearch\/* \/etc\/elasticsearch\/<br>$ cp -a \/restore\/etc\/logstash\/* \/etc\/logstash\/<br>$ cp -a \/restore\/etc\/kibana\/* \/etc\/kibana\/<br>$ cp -a \/restore\/etc\/nginx\/* \/etc\/nginx\/<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Fix permissions:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ chown -R elasticsearch:elasticsearch \/etc\/elasticsearch<br>$ chown -R logstash:logstash \/etc\/logstash<br>$ chown -R kibana:kibana \/etc\/kibana<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 9:<\/strong><br>Start Elasticsearch<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ systemctl start elasticsearch<br>$ journalctl -u elasticsearch -f<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 10:<\/strong><br>Start Kibana<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ systemctl restart kibana<br>$ journalctl -u kibana -f<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ ss -lntp | grep 5601<br>$ curl http:\/\/localhost:5601<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 11:<\/strong><br>Start Remaining Services<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>$ systemctl start logstash<br>$ systemctl start nginx<br>$ systemctl status logstash kibana nginx<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Step 12:<\/strong><br>Verify Kibana UI<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>http:\/\/111.123.123.11:5601<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2025\/12\/image-22.png\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"507\" src=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2025\/12\/image-22-1024x507.png\" alt=\"\" class=\"wp-image-9682\" srcset=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2025\/12\/image-22-1024x507.png 1024w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2025\/12\/image-22-300x148.png 300w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2025\/12\/image-22-768x380.png 768w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2025\/12\/image-22-1536x760.png 1536w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2025\/12\/image-22-606x300.png 606w, https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2025\/12\/image-22.png 1783w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction This guide explains how to restore an ELK (Elasticsearch, Logstash, Kibana) stack from backup in a clean, structured, and [&hellip;]<\/p>\n","protected":false},"author":499,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1019],"tags":[],"class_list":["post-9678","post","type-post","status-publish","format-standard","hentry","category-cloud-aws","psol-cat-cloud-aws"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-2w6","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9678","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/499"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=9678"}],"version-history":[{"count":4,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9678\/revisions"}],"predecessor-version":[{"id":9692,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9678\/revisions\/9692"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=9678"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=9678"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=9678"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}