Importing Elasticsearch Data

WARNING These instructions are rough.

Move your Elasticsearch snapshot folder to a known folder. For our example, I used /opt/snapshots.
Next you will need to tell Elasticsearch about this path by adding the path.repo directive in the configuration file. Run:
```
vim /etc/elasticsearch/elasticsearch.yml

# Add
`path.repo: ["/opt/snapshots"]`
```

Now you need to import the data itself into Elasticsearch. Import with:

curl -X PUT "localhost:9200/_snapshot/esdata?pretty" -H 'Content-Type: application/json' -d'
{
    "type": "fs",
    "settings": {
        "location": "/opt/snapshots",
        "compress": true
    }
}
'

Note: It took about 5 minutes for the snapshot to load

Next you will need to restore the snapshot by doing the following: Go to management, saved objects, import, select file on your local computer
Import dashboards into Elasticsearch curl -O http://192.168.122.1:8000/kibana-export.json

Helpful Commands

View a list of the snapshots:

curl localhost:9200/_cat/snapshots/esdata
curl -X GET "localhost:9200/_snapshot/_status?pretty"

Restore the snapshot with:

curl -X POST "localhost:9200/_snapshot/esdata/snapshot_1/_restore?pretty"

Install Moloch

Run yum install -y https://files.molo.ch/builds/centos-7/moloch-1.1.1-1.x86_64.rpm
Configure Moloch with /data/moloch/bin/Configure
Run /data/moloch/db/db.pl http://ESHOST:9200 init to init the cluster
Add user /data/moloch/bin/moloch_add_user.sh admin "Admin User" password --admin
Import your data with ./bin/moloch-capture -c etc/config.ini -R <YOUR_DIRECTORY>. You can import individual files with lowercase -r.