Clarification on cold/frozen state

Elastic Stack Elasticsearch
1

Hiya,
with the changes in version 8, the frozen tier has evolved.
I was wondering about the differences between cold, cold fully-mounted and frozen and especially between open source and enterprise/platinum versions.

My understanding is:

  • Cold: searchable in Kibana/ES, available in open source. No replica.
  • Cold fully-mounted: searchable in Kibana/ES, available in enterprise version only. Primary on cold node + snapshot.
  • Frozen: searchable in Kibana/ES, available in enterprise version only. Snapshot only?

Thank a lot for the clarification.

2

Hi @QwerFact

Good questions and yes it is a bit confusing...
And looks like you basically have it correct.

In short, Searchable Snapshots is the Enterprise Licenses Feature...
There are 2 types:

  • Fully mounted which is can be used with Cold: Fully Mounted (which pretty much acts like a normal index, but if a shard is corrupted or lost it is automatically remediated)

  • Partially Mounted which is used with Frozen: The index is partially mounted and the vast majority of the data resides in S3 with some very effective caching so searches still perform reasonably well.

And yes you are correct Cold without a searchable snapshot is just a normal index with no replicas and all the assumptions that go with that... If a shard gets lost your corrupted you will need to intervene to remediate it. This is available in Basic Subscription.

There is even more historical confusion as we used to have a frozen index feature that has long been deprecated and has nothing to do with searchable snapshots, I explained those here... for anyone that runs across this post.

1 Like
3

Great. Thanks Stephen for the explanations and confirmation.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.