Backup for Elasticsearch

[Maddy_M]

Hi,

Currently, I am using weekly indicies and I would like to take back ups for multiple indicies on weekly basis.
I need to take a full back up for the first time and then I need to take weekly back up. The reason I need weekly back up is to restore the data to another cluster in future on specific week for further investigation.

1. I checked snapshot and restore option, but I am not sure if I can restore only from specific snapshot.

2. Also, I wanted to take back up from only one node, do we need to take back up from both nodes?

Could you please advise good strategy for this?

[warkolm (Mark Walkom)]

1. Yes, you restore one specific snapshot of your choice
2. No, a backup run from one node means a backup of the entire cluster

[Maddy_M]

Hi Mark,

Thanks for the reply.

1. Regarding snapshot, the documentation describes to connect a shared file system mount to all nodes and then issue snapshot request to perform snapshots.
   I initially connected one mount to only one node for a cluster of 5 nodes. Could you please help to understand this?

2. all indexes are weekly and monthly. Can restore specific month or specific weekly index from snapshot or do we need to restore full snapshot?

[warkolm (Mark Walkom)]

1. You make the snapshot request via the API and that request can be made to any node in the cluster. But you need the snapshot mount on every node so it can copy the index data it has to the repository.
2. You can pick specific indices to restore, see https://www.elastic.co/guide/en/elasticsearch/reference/6.5/modules-snapshots.html#_restore