# Restoring indices from snapshot with rename\_replacement results in unexpected index name suffix

**URL:** <https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429>\
**Category:** OpenSearch\
**Tags:** troubleshoot\
**Created:** [March 21, 2023, 6:57am UTC](https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429 "2023-03-21T06:57:33Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![smlx](https://avatars.discourse-cdn.com/v4/letter/s/7feea3/32.png) [@smlx](https://forum.opensearch.org/u/smlx)\
**Post date:** [March 21, 2023, 6:57am UTC](https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429/1 "2023-03-21T06:57:33Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

v 1.3.2

**Describe the issue** :

When I restore an index and use the `rename_replacement` option I’m getting an unexpected suffix on the index name.

Example restore command:

```auto
curl -ksSL -u "$USER_AUTH" -XPOST -H 'Content-Type: application/json' \
https://localhost:9200/_snapshot/log-archive/2021/_restore -d \
'{"rename_pattern": ".*", "rename_replacement": "restored-$0", "indices": "*-foo-2021.04", "ignore_index_settings": ["index.routing.allocation.require.box_type"]}'

```

Expected restored index name:

```auto
restored-server-logs-foo-2021.04

```

What I get instead (note the `restored-` suffix):

```auto
restored-server-logs-foo-2021.04restored-

```

I guess this must be happening due to the `"rename_replacement": "restored-$0"` field, but I don’t understand exactly why it is happening. Any ideas?

**Configuration** :

S3 storage for snapshots, though not sure if it is relevant.

**Relevant Logs or Screenshots** :

n/a

---

<div class="post-metadata">

**Author:** ![ilyas](https://avatars.discourse-cdn.com/v4/letter/i/f04885/32.png) [@ilyas](https://forum.opensearch.org/u/ilyas)\
**Post date:** [March 21, 2023, 7:31am UTC](https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429/2 "2023-03-21T07:31:59Z")

</div>

Hi, try to change the group reference in the replacement pattern to “$1” instead of “$0” and  
rename\_pattern.

> “$1” refers to the first capture group

```auto
{
  "rename_pattern": "^(.*)",
  "rename_replacement": "restored-$1",
  "indices": "*-foo-2021.04",
  "ignore_index_settings": [
    "index.routing.allocation.require.box_type"
  ]
}

```

---

<div class="post-metadata">

**Author:** ![smlx](https://avatars.discourse-cdn.com/v4/letter/s/7feea3/32.png) [@smlx](https://forum.opensearch.org/u/smlx)\
**Post date:** [March 21, 2023, 7:38am UTC](https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429/3 "2023-03-21T07:38:06Z")

</div>

Hi, thanks for the response!

Yes that will probably work. However what I wanted to understand is _why_ my original command was not working as expected. Is it a bug in Opensearch?

According to [the documentation](https://opensearch.org/docs/2.6/tuning-your-cluster/availability-and-recovery/snapshots/snapshot-restore/#restore-snapshots), `$0` should be replaced with the original index name. So I don’t understand what is wrong with my original command?

---

<div class="post-metadata">

**Author:** ![ilyas](https://avatars.discourse-cdn.com/v4/letter/i/f04885/32.png) [@ilyas](https://forum.opensearch.org/u/ilyas)\
**Post date:** [March 21, 2023, 7:41am UTC](https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429/4 "2023-03-21T07:41:31Z")

</div>

It could be due to a bug or an implementation quirk in Elasticsearch/OpenSearch.

---

<div class="post-metadata">

**Author:** ![StuartBertramTXP](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@StuartBertramTXP](https://forum.opensearch.org/u/StuartBertramTXP)\
**Post date:** [August 10, 2026, 2:34pm UTC](https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429/5 "2026-08-10T14:34:58Z")

</div>

I’m hitting this situation in 2026, and I’m using match groups and `$1`.

What I’ve found is that it repeats the replacement (but without the match groups) when there’s only one replacement.

So:

```auto
{
  "rename_pattern": "(.*)",
  "rename_replacement": "restored-$1-index",
  ...
}

```

Gives `restored-<index_name>-indexrestored--index`

But:

```auto
{
  "rename_pattern": "(.)(.*)",
  "rename_replacement": "restored-$1$2-index",
  ...
}

```

Gives the expected `restored-<index_name>-index`, because it matches the first character and then the rest of the characters.

I don’t know _why_ it would do that. But the behaviour is consistent. One variable in the replacement: duplicated text. Two ore more variables: works as expected.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [August 12, 2026, 2:46pm UTC](https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429/6 "2026-08-12T14:46:36Z")

</div>

@StuartBertramTXP What is your OS version?

---

<div class="post-metadata">

**Author:** ![StuartBertramTXP](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@StuartBertramTXP](https://forum.opensearch.org/u/StuartBertramTXP)\
**Post date:** [August 12, 2026, 3:05pm UTC](https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429/7 "2026-08-12T15:05:46Z")

</div>

Looks like we’re still using 2.19 on AWS. I believe we updated as far as we could about a year ago, when the big EOL wave was coming for various hosted versions.

It looks like there’s 3.x versions available now. Is this something that’s fixed in 3.x, then?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [August 19, 2026, 7:55pm UTC](https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429/8 "2026-08-19T19:55:22Z")

</div>

@StuartBertramTXP As you’ve already noticed, the observed incorrect restored index name is caused by the `rename_pattern`.

> [@StuartBertramTXP](#):
>
> ```auto
> {
> "rename_pattern": "(.*)",
> "rename_replacement": "restored-$1-index",
> ...
> }
> 
> ```

When you use \* in the pattern, it matches 0 or more characters. Because `.*` can also match an empty string, the replacement is applied twice:

- `security-auditlog-2026.08.19`
- an empty string at the end of the index name

This will result in `restored-security-auditlog-2026.08.19-indexrestored--index`.  
Instead, use + in `rename_pattern`. + means 1 or more characters, so it won’t match an empty string.

```auto
{
  "rename_pattern": "(.+)",
  "rename_replacement": "restored-$1-index",
  ...
}

```

This will produce `restored-security-auditlog-2026.08.19-index`.  
It is not a bug, but expected regular expression behaviour.

---

<div class="post-metadata">

**Author:** ![StuartBertramTXP](https://avatars.discourse-cdn.com/v4/letter/s/e19b73/32.png) [@StuartBertramTXP](https://forum.opensearch.org/u/StuartBertramTXP)\
**Post date:** [August 20, 2026, 7:32am UTC](https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429/9 "2026-08-20T07:32:55Z")

</div>

@pablo Thanks for the explanation. I guess that makes some sense. But I’ve somehow managed to miss that behaviour of replacement in 20+ years of programming!

`.*` is a greedy operator, so I expect it to match any string of any length. Which is the full string. And then it’s done. It matched its input. Nothing else to do. But I’ve just checked in two different languages and they both show the same behaviour of matching the empty string at the end. Interestingly, `sed` does not and behaves as I originally expected (presumably because it’s a stream editor and so the context is slightly different)

At least we’ve got this three and a half year old oddity cleared up!

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [August 20, 2026, 2:12pm UTC](https://forum.opensearch.org/t/restoring-indices-from-snapshot-with-rename-replacement-results-in-unexpected-index-name-suffix/13429/10 "2026-08-20T14:12:07Z")

</div>

@StuartBertramTXP Great to hear that it helped. 🎉