In this blog, I am going to explain how we can take a snapshot of a single index or multiple indices to take the backup and how to restore the snapshot. We can not take the backup of Elasticsearch by just copying the data directories of all the nodes as Elasticsearch keeps on changing the contents of its data directories. So how to take the backup and how to restore it? 

Elasticsearch provides a snapshot and restores API using which we can create the snapshot and can restore it. So to create the backup we need to do the following:

• We first need to identify the directory location where we want to store the snapshot files. Let's say I want to store it in "/var/tmp/backups" directory.
  
  
• We need to provide the directory access to Elasticsearch user so that Elasticsearch can write the snapshot files.

chown -R elasticsearch. /var/tmp/backups

• Now we need to tell Elasticsearch that this is our snapshot directory location. For that, we need to add the "repo.path" setting in elasticsearch.yml file.

path.repo: ["/var/tmp/backups"]

• Here we are using the local file system directory for storing the snapshot but the same can be stored on the cloud as well. But in this blog, we will focus on file system based snapshots only.

• We first need to create the repository which would be used for taking a snapshot and to restore. We can create the repository using the following expression:

PUT _snapshot/anurag_backup
{
 "type": "fs",
 "settings": {
   "location": "/var/tmp/backups"
 }
}

• After creating the repository we can take the snapshot of all indices using the following expression:

PUT _snapshot/anurag_backup/snapshot_all_indices

• If we want to take a snapshot of one or more index only then we can specify the index name in a comma-separated form, please refer to the below expression:

PUT _snapshot/anurag_backup/snapshot_some_indices
{
 "indices": "index1, index2"
}

• If we want to see the snapshot details then we need to run the following expression:

GET _snapshot/anurag_backup/snapshot_all_indices 

The above expression provides us the snapshot details like version, list of indices, start time, end time, duration in milis, etc.

• We can restore the snapshot by appending the _restore endpoint after the snapshot name.

POST _snapshot/anurag_backup/snapshot_all_indices/_restore

We can test the restore process by first creating some indices, taking their snapshot, and then deleting those indices. After this, we can restore the snapshot to get the indices that we have deleted. I hope you can now create the snapshots and can restore them, in case of any query please leave your comment.

Other Blogs on Elastic Stack:

How to create Elasticsearch Cluster
Bucket Aggregation in Elasticsearch
Metrics Aggregation in Elasticsearch
Configure Logstash to push MySQL data into Elasticsearch
Configure Logstash to push MongoDB data into Elasticsearch
Load CSV Data into Elasticsearch
Wildcard and Boolean Search in Elasticsearch
Elasticsearch Rest API
Basics of Data Search in Elasticsearch
Elasticsearch Rest API
Log analysis with Elastic stack 
Elasticsearch Installation and Configuration on Ubuntu 14.04
Introduction to Elasticsearch

You can also follow me on:

- LinkedIn: https://www.linkedin.com/in/anubioinfo/

- Twitter: https://twitter.com/anu4udilse

- Medium: https://anubioinfo.medium.com