Searchable snapshots how it works?

Elastic Stack Elasticsearch
1

I'm new at Elastic and I need help with understanding how searchable snapshots works.
we planing a cluster with 2 hot and 2 cold nodes on prem.

In hot we plan to store data 30 days and then move to cold and use searchable snapshots on shared filesystem.

Where data will store physically? i don't understand which node I need to size storage for those data

2

Hello @Aliya_Khalel ,

Searchable snapshots allow you to use snapshots (backups) to search data stored in a very cost-effective manner.
They are particularly useful for the cold and frozen data tiers, helping reduce storage and operating costs.
By using searchable snapshots, you can eliminate the need for replica shards after rolling over from the hot tier, potentially halving the local storage needed to search your data.

When an index is mounted from a snapshot, Elasticsearch allocates its shards to data nodes within the cluster.
Data nodes then automatically retrieve the relevant shard data from the repository onto local storage, based on the mount options specified.
If possible, searches use data from local storage, which ensures efficient query performance.

3

if I use shared filesystem type for store searchable snapshots so I can place searchable snapshots not in cluster? but when I mount data from it it will take place in cluster?

4

Keep in mind that searchable snapshots are a paid feature, it is only avaiable if you have an enterprise license.

You would still need to have some nodes where the snapshot would be mounted.

The documentation has more information.

5

++ in particular, if you're using searchable snapshots then you have a support contract, please make use of it!