All Products
Search
Document Center

Elasticsearch:Automatic backup and restoration

Last Updated:Sep 08, 2025

After you enable the automatic backup feature for an Alibaba Cloud Elasticsearch (ES) instance, the system automatically backs up data based on the specified backup cycle and time. If you encounter issues such as accidental data deletion or application logic errors, you can restore data from a specific point in time to the original ES instance to ensure data security. This topic describes how to enable and disable the automatic backup feature and how to restore data from backups.

Background information

Data backup and restoration for ES instances rely on the elasticsearch-repository-oss plugin. This plugin is installed on Alibaba Cloud ES instances by default and cannot be uninstalled. For more information, see elasticsearch-repository-oss.

Precautions

  • The size of index metadata for an automatic backup cannot exceed 100 MB. If this limit is exceeded, the automatic backup task may fail. In this case, perform a manual backup.

  • The first snapshot of a cluster is a full copy of the cluster data. Subsequent snapshots synchronize only the incremental data from the previous snapshot. The first snapshot is usually large and takes a long time to create. To prevent synchronization failures, perform a manual backup for the first snapshot.

  • Snapshots save only index data. They do not save the ES instance's monitoring data, such as indexes prefixed with .monitoring and .security_audit. They also do not save metadata, Translogs, instance configurations, ES software packages, built-in and custom plugins, or ES logs.

  • Automatic backups only retain snapshot data from the last seven days. The snapshots contain full data.

  • Data from automatic backups can only be restored to the original cluster. To restore data across clusters, see Manual backup and restoration or Set up a cross-cluster OSS repository.

  • When you disable automatic backup, the system performs one final data backup. Updating the automatic backup start time does not trigger a data backup.

  • For OpenStore Indexing Service instances, the underlying storage service ensures high availability (HA) of cluster data. Therefore, the automatic backup feature is not supported.

Enable automatic backup and monitoring alarms

Enable automatic backup

    1. Go to the instance details page.

      1. Log on to the Alibaba Cloud Elasticsearch console.

      2. In the navigation pane on the left, click Elasticsearch Instances.

      3. In the top menu bar, select a resource group and a region.

      4. In the list of Elasticsearch instances, click the ID of the target instance.

  1. In the navigation pane on the left, click Data Backup.

  2. In the Snapshots (Free Trial) section, turn on Auto Snapshot.

  3. Click Set to the right of Automatic Backup Start Time.

  4. In the Automatic Backup Cycle Settings panel, select a Backup Cycle, which is the trigger time for automatic backups.

    Select the time to trigger automatic backups

    Backup cycle

    Description

    Every 30 Minutes

    An automatic backup is performed every 30 minutes.

    Daily

    An automatic backup is performed every day. You can customize the backup time.

    Custom

    Customize the backup cycle and time.

    Important

    The backup time is the local time of the region where the instance resides.

  5. Click OK.

Enable monitoring alarms

After you enable automatic backup, you should also enable one-click alerts. This lets you monitor the status of snapshot backups and promptly identify and handle any exceptions. On the monitoring page, if the Snapshot Status (value) metric is 2, it indicates that the snapshot task failed.

92f3c2e14bd785171e8a050e2c5265fc

You can run the /_cat/snapshots/aliyun_auto_snapshot?format=json command to view the status details of the latest snapshot and then manually back up the relevant data.

Note

Snapshot statuses include the following:

  • SUCCESS: All shards were successfully backed up.

  • PARTIAL: Some shards failed to back up.

  • FAILED: The backup task failed.

If no recent snapshot exists, it means that the backup task was not triggered and no record was created. For example, the system may not perform an automatic backup because of a cluster or node exception.

The following image shows an example of snapshot details.

image

View backup snapshots

After you enable the automatic backup feature, you can log on to the Kibana console. On the Kibana console of the corresponding Alibaba Cloud Elasticsearch instance, use the _snapshot API to view information about automatic backup snapshots:

  • View the snapshot repository.

    GET _snapshot

    A successful request returns a response similar to the following example.

    {
      "aliyun_auto_snapshot" : {
        "type" : "oss",
        "settings" : {
          "compress" : "true",
          "base_path" : "cf95b9-185320276651****/es-cn-09k2053us0003****",
          "endpoint" : "http://oss-cn-hangzhou-internal.aliyuncs.com"
        }
      }
    }
                                

    Parameter

    Description

    aliyun_auto_snapshot

    The automatic snapshot repository is created when the first snapshot is taken. The name of the repository that stores automatic backup snapshots for Alibaba Cloud Elasticsearch is fixed as aliyun_auto_snapshot.

    Note

    A repository can store multiple snapshots. Each snapshot can contain the backup data of all, some, or a single index.

    type

    The storage medium for snapshots. oss indicates that the storage medium is Object Storage Service (OSS).

    compress

    Specifies whether to enable compression for snapshot files:

    • true: Enables compression. This applies only to metadata files, which include index mappings and settings.

    • false (default): Disables compression. Data files are not compressed.

    base_path

    The storage location of the snapshot in OSS.

    endpoint

    Information about the region where OSS is located.

  • View information about all snapshots in the aliyun_auto_snapshot repository.

    GET _snapshot/aliyun_auto_snapshot/_all

    A successful request returns a response similar to the following example.

    {
      "snapshots": [
        {
          "snapshot": "es-cn-09k2053us0003****_20210117030003",
          "uuid": "vIdSCkthTeGa0nSj4D****",
          "version_id": 5050399,
          "version": "5.5.3",
          "indices": [
            ".kibana"
          ],
          "state": "SUCCESS",
          "start_time": "2018-06-28T01:22:39.609Z",
          "start_time_in_millis": 1530148959609,
          "end_time": "2018-06-28T01:22:39.923Z",
          "end_time_in_millis": 1530148959923,
          "duration_in_millis": 314,
          "failures": [],
          "shards": {
            "total": 1,
            "failed": 0,
            "successful": 1
          }
        },
        {
          "snapshot": "es-cn-09k2053us0003****_20210118030004",
          "uuid": "XKO_Uwz_Qu6mZrU3Am****",
          "version_id": 5050399,
          "version": "5.5.3",
          "indices": [
            ".kibana"
          ],
          "state": "SUCCESS",
          "start_time": "2018-06-28T01:25:00.764Z",
          "start_time_in_millis": 1530149100764,
          "end_time": "2018-06-28T01:25:01.482Z",
          "end_time_in_millis": 1530149101482,
          "duration_in_millis": 718,
          "failures": [],
          "shards": {
            "total": 1,
            "failed": 0,
            "successful": 1
          }
        }
      ]
    }
    Important

    The backup time is in the local time of the region where the instance resides. However, the time in the returned response is in Coordinated Universal Time (UTC). A time zone difference exists between the two. You can convert the time based on this difference. For example, the time zone difference for UTC+8 is 8 hours. Therefore, UTC+8 = UTC + 0800.

    The state parameter indicates the snapshot status. Snapshots for an Alibaba Cloud Elasticsearch instance can have one of the following five statuses.

    Snapshot status

    Description

    IN_PROGRESS

    The snapshot is in progress.

    SUCCESS

    The snapshot process is complete, and all data from all shards is successfully stored.

    FAILED

    The snapshot process is complete, but data from some indexes was not successfully stored.

    PARTIAL

    Some data was stored successfully, but data from at least one shard was not stored.

    INCOMPATIBLE

    The snapshot is incompatible with the version of the Alibaba Cloud Elasticsearch instance.

    Automatic backup snapshots also have the following default parameters that are not displayed.

    Parameter

    Description

    max_snapshot_bytes_per_sec

    The maximum speed for data backup on a single node. The default value is 40mb per second.

    max_restore_bytes_per_sec

    The maximum speed for data restoration on a single node. The default value is 40mb per second.

    chunk_size

    When creating a snapshot, large files are split into smaller chunks. This parameter sets the size of the chunks, such as 1g, 10m, or 5k. The default value is null, which means there is no limit.

  • View detailed information about a specific snapshot in the aliyun_auto_snapshot repository.

    GET _snapshot/aliyun_auto_snapshot/<snapshot>/_status

    <snapshot>: The name of the automatic backup snapshot. You can retrieve this name by running the command to view all snapshots. For example: es-cn-09k2053us0003****_20210118030004.

    A successful request returns a response similar to the following example.

    {
      "snapshots": [
        {
          "snapshot": "es-cn-09k2053us0003****_20210118030004",
          "repository": "aliyun_auto_snapshot",
          "uuid": "XKO_Uwz_Qu6mZrU3Am****",
          "state": "SUCCESS",
          "shards_stats": {
            "initializing": 0,
            "started": 0,
            "finalizing": 0,
            "done": 1,
            "failed": 0,
            "total": 1
          },
          "stats": {
            "number_of_files": 4,
            "processed_files": 4,
            "total_size_in_bytes": 3296,
            "processed_size_in_bytes": 3296,
            "start_time_in_millis": 1530148959688,
            "time_in_millis": 77
          },
          "indices": {
            ".kibana": {
              "shards_stats": {
                "initializing": 0,
                "started": 0,
                "finalizing": 0,
                "done": 1,
                "failed": 0,
                "total": 1
              },
              "stats": {
                "number_of_files": 4,
                "processed_files": 4,
                "total_size_in_bytes": 3296,
                "processed_size_in_bytes": 3296,
                "start_time_in_millis": 1530148959688,
                "time_in_millis": 77
              },
              "shards": {
                "0": {
                  "stage": "DONE",
                  "stats": {
                    "number_of_files": 4,
                    "processed_files": 4,
                    "total_size_in_bytes": 3296,
                    "processed_size_in_bytes": 3296,
                    "start_time_in_millis": 1530148959688,
                    "time_in_millis": 77
                  }
                }
              }
            }
          }
        }
      ]
    }

Restore data from an automatic backup

After an automatic backup is complete, you can use the _restore API to restore data to the original Elasticsearch instance.

Important

Restoring system indexes, which start with a period (.), may cause Kibana access to fail. Do not restore system indexes.

On the Kibana console, run the following commands to restore index data from a snapshot:

  • Restore all indexes from a specific snapshot in the aliyun_auto_snapshot repository. The task runs in the background.

    POST _snapshot/aliyun_auto_snapshot/<snapshot>/_restore

    <snapshot>: The name of the automatic backup snapshot, such as es-cn-abcdefghij****_20180627091600.

  • Restore all indexes from a specific snapshot in the aliyun_auto_snapshot repository and wait for the task to complete.

    The _restore API is an asynchronous invocation. The instance returns a response immediately after it confirms that the restore operation can be performed, and the restore job runs in the background. You can append the wait_for_completion parameter to block the call until the restoration is complete.

    POST _snapshot/aliyun_auto_snapshot/<snapshot>/_restore?wait_for_completion=true

    <snapshot>: The name of the automatic backup snapshot, such as es-cn-abcdefghij****_20180627091600.

  • Restore specific indexes from a specific snapshot in the aliyun_auto_snapshot repository and rename the restored indexes. The task runs in the background.

    POST _snapshot/aliyun_auto_snapshot/<snapshot>/_restore
    {
    "indices": "index_1",
    "rename_pattern": "index_(.+)",
    "rename_replacement": "restored_index_$1"
    }

    Parameter

    Description

    <snapshot>

    The name of the automatic backup snapshot, such as es-cn-abcdefghij****_20180627091600.

    indices

    The name of the index to restore.

    rename_pattern

    Optional. A regular expression to match the names of the indexes to restore.

    rename_replacement

    Optional. A rule to rename the matched indexes.

Disable automatic backup

  1. Log on to the Alibaba Cloud Elasticsearch console.

  2. In the left-side navigation pane, click Elasticsearch Clusters.

  3. Navigate to the desired cluster.

    1. In the top navigation bar, select the resource group to which the cluster belongs and the region where the cluster resides.

    2. On the Elasticsearch Clusters page, find the cluster and click its ID.

  4. In the navigation pane on the left, click Data Backup.

  5. In the Snapshots (Free Trial) section, turn off Auto Snapshot.

References