After you enable the automatic backup feature for an Alibaba Cloud Elasticsearch (ES) instance, the system automatically backs up data based on the specified backup cycle and time. If you encounter issues such as accidental data deletion or application logic errors, you can restore data from a specific point in time to the original ES instance to ensure data security. This topic describes how to enable and disable the automatic backup feature and how to restore data from backups.
Background information
Data backup and restoration for ES instances rely on the elasticsearch-repository-oss plugin. This plugin is installed on Alibaba Cloud ES instances by default and cannot be uninstalled. For more information, see elasticsearch-repository-oss.
Precautions
The size of index metadata for an automatic backup cannot exceed
100 MB. If this limit is exceeded, the automatic backup task may fail. In this case, perform a manual backup.The first snapshot of a cluster is a full copy of the cluster data. Subsequent snapshots synchronize only the incremental data from the previous snapshot. The first snapshot is usually large and takes a long time to create. To prevent synchronization failures, perform a manual backup for the first snapshot.
Snapshots save only index data. They do not save the ES instance's monitoring data, such as indexes prefixed with .monitoring and .security_audit. They also do not save metadata, Translogs, instance configurations, ES software packages, built-in and custom plugins, or ES logs.
Automatic backups only retain snapshot data from the last seven days. The snapshots contain full data.
Data from automatic backups can only be restored to the original cluster. To restore data across clusters, see Manual backup and restoration or Set up a cross-cluster OSS repository.
When you disable automatic backup, the system performs one final data backup. Updating the automatic backup start time does not trigger a data backup.
For OpenStore Indexing Service instances, the underlying storage service ensures high availability (HA) of cluster data. Therefore, the automatic backup feature is not supported.
Enable automatic backup and monitoring alarms
Enable automatic backup
Go to the instance details page.
Log on to the Alibaba Cloud Elasticsearch console.
In the navigation pane on the left, click Elasticsearch Instances.
In the top menu bar, select a resource group and a region.
In the list of Elasticsearch instances, click the ID of the target instance.
In the navigation pane on the left, click Data Backup.
In the Snapshots (Free Trial) section, turn on Auto Snapshot.
Click Set to the right of Automatic Backup Start Time.
In the Automatic Backup Cycle Settings panel, select a Backup Cycle, which is the trigger time for automatic backups.

Backup cycle
Description
Every 30 Minutes
An automatic backup is performed every 30 minutes.
Daily
An automatic backup is performed every day. You can customize the backup time.
Custom
Customize the backup cycle and time.
ImportantThe backup time is the local time of the region where the instance resides.
Click OK.
Enable monitoring alarms
After you enable automatic backup, you should also enable one-click alerts. This lets you monitor the status of snapshot backups and promptly identify and handle any exceptions. On the monitoring page, if the Snapshot Status (value) metric is 2, it indicates that the snapshot task failed.

You can run the /_cat/snapshots/aliyun_auto_snapshot?format=json command to view the status details of the latest snapshot and then manually back up the relevant data.
Snapshot statuses include the following:
SUCCESS: All shards were successfully backed up.
PARTIAL: Some shards failed to back up.
FAILED: The backup task failed.
If no recent snapshot exists, it means that the backup task was not triggered and no record was created. For example, the system may not perform an automatic backup because of a cluster or node exception.
The following image shows an example of snapshot details.

View backup snapshots
After you enable the automatic backup feature, you can log on to the Kibana console. On the Kibana console of the corresponding Alibaba Cloud Elasticsearch instance, use the _snapshot API to view information about automatic backup snapshots:
View the snapshot repository.
GET _snapshotA successful request returns a response similar to the following example.
{ "aliyun_auto_snapshot" : { "type" : "oss", "settings" : { "compress" : "true", "base_path" : "cf95b9-185320276651****/es-cn-09k2053us0003****", "endpoint" : "http://oss-cn-hangzhou-internal.aliyuncs.com" } } }Parameter
Description
aliyun_auto_snapshot
The automatic snapshot repository is created when the first snapshot is taken. The name of the repository that stores automatic backup snapshots for Alibaba Cloud Elasticsearch is fixed as aliyun_auto_snapshot.
NoteA repository can store multiple snapshots. Each snapshot can contain the backup data of all, some, or a single index.
type
The storage medium for snapshots. oss indicates that the storage medium is Object Storage Service (OSS).
compress
Specifies whether to enable compression for snapshot files:
true: Enables compression. This applies only to metadata files, which include index mappings and settings.
false (default): Disables compression. Data files are not compressed.
base_path
The storage location of the snapshot in OSS.
endpoint
Information about the region where OSS is located.
View information about all snapshots in the aliyun_auto_snapshot repository.
GET _snapshot/aliyun_auto_snapshot/_allA successful request returns a response similar to the following example.
{ "snapshots": [ { "snapshot": "es-cn-09k2053us0003****_20210117030003", "uuid": "vIdSCkthTeGa0nSj4D****", "version_id": 5050399, "version": "5.5.3", "indices": [ ".kibana" ], "state": "SUCCESS", "start_time": "2018-06-28T01:22:39.609Z", "start_time_in_millis": 1530148959609, "end_time": "2018-06-28T01:22:39.923Z", "end_time_in_millis": 1530148959923, "duration_in_millis": 314, "failures": [], "shards": { "total": 1, "failed": 0, "successful": 1 } }, { "snapshot": "es-cn-09k2053us0003****_20210118030004", "uuid": "XKO_Uwz_Qu6mZrU3Am****", "version_id": 5050399, "version": "5.5.3", "indices": [ ".kibana" ], "state": "SUCCESS", "start_time": "2018-06-28T01:25:00.764Z", "start_time_in_millis": 1530149100764, "end_time": "2018-06-28T01:25:01.482Z", "end_time_in_millis": 1530149101482, "duration_in_millis": 718, "failures": [], "shards": { "total": 1, "failed": 0, "successful": 1 } } ] }ImportantThe backup time is in the local time of the region where the instance resides. However, the time in the returned response is in Coordinated Universal Time (UTC). A time zone difference exists between the two. You can convert the time based on this difference. For example, the time zone difference for UTC+8 is 8 hours. Therefore, UTC+8 = UTC + 0800.
The state parameter indicates the snapshot status. Snapshots for an Alibaba Cloud Elasticsearch instance can have one of the following five statuses.
Snapshot status
Description
IN_PROGRESS
The snapshot is in progress.
SUCCESS
The snapshot process is complete, and all data from all shards is successfully stored.
FAILED
The snapshot process is complete, but data from some indexes was not successfully stored.
PARTIAL
Some data was stored successfully, but data from at least one shard was not stored.
INCOMPATIBLE
The snapshot is incompatible with the version of the Alibaba Cloud Elasticsearch instance.
Automatic backup snapshots also have the following default parameters that are not displayed.
Parameter
Description
max_snapshot_bytes_per_sec
The maximum speed for data backup on a single node. The default value is 40mb per second.
max_restore_bytes_per_sec
The maximum speed for data restoration on a single node. The default value is 40mb per second.
chunk_size
When creating a snapshot, large files are split into smaller chunks. This parameter sets the size of the chunks, such as 1g, 10m, or 5k. The default value is null, which means there is no limit.
View detailed information about a specific snapshot in the aliyun_auto_snapshot repository.
GET _snapshot/aliyun_auto_snapshot/<snapshot>/_status<snapshot>: The name of the automatic backup snapshot. You can retrieve this name by running the command to view all snapshots. For example: es-cn-09k2053us0003****_20210118030004.
A successful request returns a response similar to the following example.
{ "snapshots": [ { "snapshot": "es-cn-09k2053us0003****_20210118030004", "repository": "aliyun_auto_snapshot", "uuid": "XKO_Uwz_Qu6mZrU3Am****", "state": "SUCCESS", "shards_stats": { "initializing": 0, "started": 0, "finalizing": 0, "done": 1, "failed": 0, "total": 1 }, "stats": { "number_of_files": 4, "processed_files": 4, "total_size_in_bytes": 3296, "processed_size_in_bytes": 3296, "start_time_in_millis": 1530148959688, "time_in_millis": 77 }, "indices": { ".kibana": { "shards_stats": { "initializing": 0, "started": 0, "finalizing": 0, "done": 1, "failed": 0, "total": 1 }, "stats": { "number_of_files": 4, "processed_files": 4, "total_size_in_bytes": 3296, "processed_size_in_bytes": 3296, "start_time_in_millis": 1530148959688, "time_in_millis": 77 }, "shards": { "0": { "stage": "DONE", "stats": { "number_of_files": 4, "processed_files": 4, "total_size_in_bytes": 3296, "processed_size_in_bytes": 3296, "start_time_in_millis": 1530148959688, "time_in_millis": 77 } } } } } } ] }
Restore data from an automatic backup
After an automatic backup is complete, you can use the _restore API to restore data to the original Elasticsearch instance.
Restoring system indexes, which start with a period (.), may cause Kibana access to fail. Do not restore system indexes.
On the Kibana console, run the following commands to restore index data from a snapshot:
Restore all indexes from a specific snapshot in the aliyun_auto_snapshot repository. The task runs in the background.
POST _snapshot/aliyun_auto_snapshot/<snapshot>/_restore<snapshot>: The name of the automatic backup snapshot, such as es-cn-abcdefghij****_20180627091600.
Restore all indexes from a specific snapshot in the aliyun_auto_snapshot repository and wait for the task to complete.
The _restore API is an asynchronous invocation. The instance returns a response immediately after it confirms that the restore operation can be performed, and the restore job runs in the background. You can append the wait_for_completion parameter to block the call until the restoration is complete.
POST _snapshot/aliyun_auto_snapshot/<snapshot>/_restore?wait_for_completion=true<snapshot>: The name of the automatic backup snapshot, such as es-cn-abcdefghij****_20180627091600.
Restore specific indexes from a specific snapshot in the aliyun_auto_snapshot repository and rename the restored indexes. The task runs in the background.
POST _snapshot/aliyun_auto_snapshot/<snapshot>/_restore { "indices": "index_1", "rename_pattern": "index_(.+)", "rename_replacement": "restored_index_$1" }Parameter
Description
<snapshot>
The name of the automatic backup snapshot, such as es-cn-abcdefghij****_20180627091600.
indices
The name of the index to restore.
rename_pattern
Optional. A regular expression to match the names of the indexes to restore.
rename_replacement
Optional. A rule to rename the matched indexes.
Disable automatic backup
Log on to the Alibaba Cloud Elasticsearch console.
In the left-side navigation pane, click Elasticsearch Clusters.
Navigate to the desired cluster.
In the top navigation bar, select the resource group to which the cluster belongs and the region where the cluster resides.
On the Elasticsearch Clusters page, find the cluster and click its ID.
In the navigation pane on the left, click Data Backup.
In the Snapshots (Free Trial) section, turn off Auto Snapshot.