A snapshot can be restored using the following command:

curl -XPOST localhost:9200/_snapshot/my_backup/first_snapshot/_restore

The _restore is the REST endpoint for restore operations. It restores the snapshot mentioned in the previous parameter. The preceding command will restore all indices of the specified snapshot name. If you want to restore just certain indices, you must be specify the list of indices in the body of the request:

curl -XPOST localhost:9200/_snapshot/my_backup/first_snapshot/_restore -d '{
  "indices": "my_index",
  "ignore_unavailable": "true",
  "include_global_state": false,
  "include_aliases": false,
  "partial": true,
  "rename_pattern": "my_(.+)",
  "rename_replacement": "restored_$1"
}'

The indices parameter defines the index names that need to be restored. It supports multi-index syntax. For example, when the * character is used, Elasticsearch will restore all indices of the specified snapshot. If you do not want to restore the aliases, the include_aliases parameter should be set to false.

By default, the restore operation will fail if one or more indices that need to be restored don't have snapshots of all shards available. This behavior can be changed by setting the partial parameter to true. In this case, only successfully snapshotted shards will be restored and all missing shards will be recreated as empty. Also, you can rename the index that needs to be restored using a regular expression with the rename_pattern and rename_replacement parameters. In the preceding use, the index named my_index will be restored with restored_index name.

When an index restore operation is performed on an existing and open index, it will fail:

{
   "error": "SnapshotRestoreException[[my_backup:first_snapshot] cannot restore index [my_index] because it's open]",
   "status": 500
}

You can close the index before the restore operation, as follows:

curl -XPOST localhost:9200/my_index/_close

Closed indices are opened during the restore operation. Elasticsearch creates new indices if they didn't exist in the cluster. The restore operation uses the Elasticsearch standard shard recovery mechanism. Therefore, if you want to cancel a restore operation that is running, you can use index delete command on the indices that are being restored.

curl -XPOST localhost:9200/_snapshot/my_backup/first_snapshot/_restore -d '{
"indices": "my_index",
  "index_settings": {
    "index.number_of_replicas": 2
  },
  "ignore_index_settings": [
      "index.refresh_interval"
  ]
}'