Understanding Point-in-Time Recovery (PITR) & Backup Strategies in Elastic Cloud

Elastic Stack Elasticsearch
1

I have an Elastic Cloud account and I'm trying to understand if Point-in-Time Recovery (PITR) is possible using Elasticsearch snapshots.

From what I’ve read, snapshots in Elasticsearch seem to be full backups (similar to full backups in SQL Server) rather than incremental ones. Given this, I have a few concerns:

  1. If I schedule daily snapshots at 8 PM, what happens if something goes wrong at 4 PM today?
  2. Would I lose all changes made between 8 PM last night and 4 PM today?
  3. Is there an alternative way to recover recent data outside of the last snapshot?

Possible Solutions & Questions:

  • Index Lifecycle Policies (ILM): Can ILM help in this scenario to ensure data retention and minimize loss?
  • Replication Options: Would setting up replicas help, or are they mainly for high availability rather than recovery?
  • Third-Party PITR Solutions: Does Elastic Cloud support any third-party tools for PITR? If so, which ones?
  • Elastic Cloud PITR Features & Pricing: Does Elastic Cloud provide a built-in PITR solution? If yes, what’s the pricing, and how do I set it up?
  • Scaling Considerations: What are the best practices to scale Elastic Cloud while ensuring minimal data loss?
  • Official Documentation: Are there any official guides on setting up PITR (if available) or strategies to reduce potential data loss?

I’m really concerned about potential data loss if something goes wrong before the next scheduled backup. This isn’t just about data—it includes time, money, and business impact.

I’d appreciate any insights, recommendations, or documentation that can help!

2

Each snapshot is indeed a full snapshot.

Correct.

Elasticsearch snapshots are performed at the sement level and segments are immutable. Segments that have are still persent are reused/shared between snapshots and only new segements are added to the snapshot repository for every snapshot, reducing the amount of storage used. It is therefore common to take snapshots with a greater frequency than in your example and I believe Elastic Cloud internally do so every 30 minutes.