# Offload cold data to s3 in cloud

**URL:** <https://discuss.elastic.co/t/offload-cold-data-to-s3-in-cloud/144441>\
**Category:** Elasticsearch\
**Created:** [August 15, 2018, 2:54am UTC](https://discuss.elastic.co/t/offload-cold-data-to-s3-in-cloud/144441 "2018-08-15T02:54:54Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![yiguolei](https://avatars.discourse-cdn.com/v4/letter/y/54ee81/32.png) [@yiguolei](https://discuss.elastic.co/u/yiguolei)\
**Post date:** [August 15, 2018, 2:54am UTC](https://discuss.elastic.co/t/offload-cold-data-to-s3-in-cloud/144441/1 "2018-08-15T02:54:54Z")

</div>

In log analysis scenario, user could offload the cold data to s3 to reduce the cost. For example, vertica has support this feature. Does es have the plan to do this?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 15, 2018, 4:04am UTC](https://discuss.elastic.co/t/offload-cold-data-to-s3-in-cloud/144441/2 "2018-08-15T04:04:27Z")

</div>

We are working on something called frozen indices that will let you sequentially search though previously closed indices. I am not sure of the timeline for that though.

---

<div class="post-metadata">

**Author:** ![yiguolei](https://avatars.discourse-cdn.com/v4/letter/y/54ee81/32.png) [@yiguolei](https://discuss.elastic.co/u/yiguolei)\
**Post date:** [August 15, 2018, 4:35am UTC](https://discuss.elastic.co/t/offload-cold-data-to-s3-in-cloud/144441/3 "2018-08-15T04:35:19Z")

</div>

could you provide more details about " sequentially search though previously closed indices" ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 15, 2018, 4:57am UTC](https://discuss.elastic.co/t/offload-cold-data-to-s3-in-cloud/144441/4 "2018-08-15T04:57:02Z")

</div>

Closed indices cannot be read, you need to open them, recover them and then read the data (and reclose them if you want). This needs to be done manually at the moment and we are working on a process to automate this.

So if you have indices from 2015, 2016 and 2017 that are all closed and you query for data that lives in 2015 and 2016 indices, it will open+recover+read+close the 2015 indices, then the 2016 indices automatically.

This means you don 't end up using heap for lots of open shards.

---

<div class="post-metadata">

**Author:** ![yiguolei](https://avatars.discourse-cdn.com/v4/letter/y/54ee81/32.png) [@yiguolei](https://discuss.elastic.co/u/yiguolei)\
**Post date:** [August 15, 2018, 5:12am UTC](https://discuss.elastic.co/t/offload-cold-data-to-s3-in-cloud/144441/5 "2018-08-15T05:12:41Z")

</div>

Does the closed index is still in local disk or is moved to shared storage like s3?  
I think it is better to move the closed index to s3 because it does not need to maintain replicas in es cluster and s3 is a bit cheaper than local storage. When user want to read the closed index, just open and read it doest not need recovery any more.

what do you think about it.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 15, 2018, 5:23am UTC](https://discuss.elastic.co/t/offload-cold-data-to-s3-in-cloud/144441/6 "2018-08-15T05:23:51Z")

</div>

Closed indices still need to reside on disk. Elasticsearch does not support querying live indices from S3. Given the access patterns of Elasticsearch when querying, trying to serve queries from S3 (if it was possible) would most likely be unacceptably slow.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 12, 2018, 5:23am UTC](https://discuss.elastic.co/t/offload-cold-data-to-s3-in-cloud/144441/7 "2018-09-12T05:23:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
