4

I was trying to delete a particular record, but I have accidentally deleted the entire index(rnd_prod). Below is the code I used to delete.

DELETE /rnd_prod/
{
   "query": {

      "ids": {
         "type": "rnd_prod",
         "values": [
            "KXqye2AtRcCwSei7c_Wx_A"
            ]
      }

   }
}

A grave mistake :( I feel hopefull though because It seems elasticSearch doesnt physically delete the data immediately, until something called merging happens(reference).

Please help.. I donot have any backups/snapshots of this index..

pauljeba
  • 760
  • 2
  • 10
  • 27
  • 1
    Ouch, that hurts. You might try to check if you still have the files in your data folder in `/nodes/0/indices/rnd_prod` and copy that folder somewhere safe. Also see this: http://stackoverflow.com/questions/29702518/backing-up-deleting-restoring-elasticsearch-indexes-by-index-folder – Val Apr 12 '16 at 12:30
  • @Val Thank you for your suggestion. I checked the folder. The size is very small, I think only new data is present in it :( – pauljeba Apr 12 '16 at 13:13
  • Yes, beware of tinkering in PROD and always create a snapshot once you have indexed all your data and then regularly. – Val Apr 12 '16 at 13:17
  • @val Yeah.. Lesson learnt. Would you know if it is possible to work with Lucene and revert back the old data? [link](https://www.elastic.co/blog/lucenes-handling-of-deleted-documents) – pauljeba Apr 12 '16 at 13:23
  • Once the index data is gone from the data folder (which seems to be your case), there's no way to get it back. Unless you want to work with a file undeleter tool, but that's a whole different job, and not sure it's worth it. You're probably better off reindexing your data. – Val Apr 12 '16 at 13:28

0 Answers0