Snapshot and Restore

Snapshots are the only backup mechanism for these clusters. They are incremental at the segment level: a snapshot stores only segments not already in the repository.

Repository

PUT /_snapshot/backups
{
  "type": "s3",
  "settings": {
    "bucket": "acme-search-backups",
    "region": "eu-central-1",
    "base_path": "prod",
    "compress": true
  }
}
 
POST /_snapshot/backups/_verify

The repository-s3 plugin (or the equivalent for your storage) must be installed on every node, and credentials configured in the keystore rather than in the repository settings.

Taking snapshots

PUT /_snapshot/backups/snapshot-20260731?wait_for_completion=false
{
  "indices": "orders,articles,logs-*",
  "include_global_state": true
}
 
GET /_snapshot/backups/_current
GET /_snapshot/backups/_all?verbose=false

include_global_state: true captures cluster settings, index templates and lifecycle policies — without them a restored cluster lacks the configuration that makes the indices behave correctly.

Automate with a policy:

PUT /_slm/policy/daily-snapshots
{
  "schedule": "0 30 1 * * ?",
  "name": "<prod-snap-{now/d}>",
  "repository": "backups",
  "config": { "indices": ["*"], "include_global_state": true },
  "retention": { "expire_after": "30d", "min_count": 7, "max_count": 60 }
}

Restoring

POST /_snapshot/backups/snapshot-20260731/_restore
{
  "indices": "orders",
  "rename_pattern": "(.+)",
  "rename_replacement": "restored-$1",
  "include_aliases": false
}

GET /_cat/recovery?v&active_only=true

Restore speed is bounded by indices.recovery.max_bytes_per_sec; raising it speeds recovery and competes with live traffic.

Verification

Version compatibility

Snapshots can generally be restored into the same or a newer major version within a supported range, and never into an older one. Before an upgrade, confirm that your existing snapshots will still be restorable by the version you are moving to — that constraint has stranded teams mid-upgrade.

Searchable snapshots

Where available, searchable snapshots let cold-tier indices be queried directly from the repository without keeping a full local copy, substantially reducing storage for rarely accessed history. Feature availability depends on the distribution and licence, so verify before designing a retention plan around it.