what I have done is that mount xfs file system to all masters/data node
and then run a bash script to do snapshot every other day and remove week old snapshot
It is three step process
mount fs
register snapshot (elk knows where to save data, name etc..)
run actual backup (data gets backed up here)
https://discuss.elastic.co/t/automatic-elasticsearch-snapshot-backup/173223