Moving data from stash back to an index?

[claudiaG]

Hello all,

following use case:

We wanted to create a backup of some json data. For this we created a new index called  "xyz_backup" and moved all data from the original index to it. By doing that the sourcetype was set to "stash" in the backup index.

Now we want to move the data from the "xyz_backup" index back to the original index. But the sourcetype should be json again and also the field extraction should be back.

By running following command the only thing that happens is that the sourcetype gets set to "json" but the data itself is still not in the right json format (field extractions not working etc.).:

index=xyz_backup
| collect index=original sourcetype=_json

How can we get the data back into its original format (json)?

The original data is still available and could maybe be "read-in" again by resetting the fishbucket but the bad thing is its only possible for individual files right? not for a complete folder? because we have over 100files...

Thanks in advance for your help or a quick tip.

[PickleRick · Accepted solution]

I'd suggest going over your source files with a script and resetting fishbucket for those entries to reingest them again.

1. Depending on what you did in your summary-creating search, the stash events contents are simply no longer the same as the original events and short of doing some strange magic to "untangle" it (and for this you have to know exactly what the search did and how it transformed the events) you can't "recreate" the original events. (compare it to making photos of postcards - if you only did photos of the postcard picture, you have no way of knowing what was written on the back).

2. Even if you put in the effort and were able to re-make your jsons, collecting them with any other sourcetype than stash would incure license usage anyway.

So probably the easiest way is to reingest the events from the source.