Sync 2 Elasticsearch clusters

Hello,

I will sync 2 Clusters. One cluster is read only and it is not possible to send the updates to the read only cluster. Only the write cluster has a static IP. The read only cluster must poll the changes. What is the best way for syncing the clusters? logstash or syncing the snapshots? A process update, delete and add documents. But I isn't necessary to sync the deleted documents.

Cheers,
Michael

Probably snapshot and restore.