How to takes elasticsearch backup on closed indexes in a clustered environment

I've configured 3-node clustered ELK nodes and also configured snapshot feature.
But I need to take a backup of closed indexes.
Re-open & take a snapshot is not practical. Is there another way to do this?

Hi @krishanr,

You can take backup only for open indices not for closed indices.

No, There is no other way to do the same you can take backup before close the indices.

However, There is a temporary solution to achieve the result but i don't know it will work with your environment or not.
Temp solution:
You can tar'ing up and gzip'ing a closed index and deleting the original directory, then unzip'ing and re-opening the index in ES and that works. I've tried this once in my environment.

Harsh Bajaj

To be clear, in no sense does this process "work" as a backup solution, and this fact is called out in the documentation:

WARNING: It is not possible to back up an Elasticsearch cluster simply by taking a copy of the data directories of all of its nodes. Elasticsearch may be making changes to the contents of its data directories while it is running, and this means that copying its data directories cannot be expected to capture a consistent picture of their contents. Attempts to restore a cluster from such a backup may fail, reporting corruption and/or missing files, or may appear to have succeeded having silently lost some of its data. The only reliable way to back up a cluster is by using the snapshot and restore functionality.

In versions 7.2.0 and later you can snapshot closed indices. In earlier versions you must re-open them to take a snapshot, and this is the only reliable and supported way to make a backup.


Hi @DavidTurner,

I also agree with it thats why i mentioned its temp. solution and will work it or not. I give this because i have tried once in my environment and it worked for me.

Harsh Bajaj

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.