# Replication with filtering

**URL:** <https://discuss.elastic.co/t/replication-with-filtering/75433>\
**Category:** Elasticsearch\
**Created:** [February 17, 2017, 5:04am UTC](https://discuss.elastic.co/t/replication-with-filtering/75433 "2017-02-17T05:04:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lavalyte](https://avatars.discourse-cdn.com/v4/letter/l/71c47a/32.png) [@Lavalyte](https://discuss.elastic.co/u/Lavalyte)\
**Post date:** [February 17, 2017, 5:04am UTC](https://discuss.elastic.co/t/replication-with-filtering/75433/1 "2017-02-17T05:04:08Z")

</div>

Hi,

I have a use case I am not sure how to cater for.  
We have an elasticsearch db that takes a high volume of logged information per second.  
We have a requirement to archive some of that volume off.  
I am hoping we can archive to a second elasticsearch db.

I know elasticsearch does replication. The question I have is, can it replicate with filtering, to only replicate what we want it to?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 17, 2017, 6:47am UTC](https://discuss.elastic.co/t/replication-with-filtering/75433/2 "2017-02-17T06:47:36Z")

</div>

Replication is not designed for this need.

But, you have other choices:

- let say you want to archive by date. Use time based indices and just change index allocation to allocate old indices to archive nodes
- use reindex from remote: so reindex with a query from one cluster to another. Then use delete by query to remove old data.

May be there are other ways but it depends on the kind of data you want to archive (what is the type of query you want to run basically)

---

<div class="post-metadata">

**Author:** ![Lavalyte](https://avatars.discourse-cdn.com/v4/letter/l/71c47a/32.png) [@Lavalyte](https://discuss.elastic.co/u/Lavalyte)\
**Post date:** [February 19, 2017, 10:14pm UTC](https://discuss.elastic.co/t/replication-with-filtering/75433/3 "2017-02-19T22:14:17Z")

</div>

We want to backup the content of specific indices. When writing a query on es I believe there is no longer a general creation timestamp on each document we could use to only grab the incremental?

I am looking at  
[https://www.npmjs.com/package/elasticdump](https://www.npmjs.com/package/elasticdump)  
as a solution atm.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 19, 2017, 10:14pm UTC](https://discuss.elastic.co/t/replication-with-filtering/75433/4 "2017-03-19T22:14:27Z")

</div>

Closed on March 19, 2017, 10:14pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.