Elasticsearch OpenSearch Snapshot

By Opster Team

Updated: Jun 19, 2024

| 3 min read

Quick links


An OpenSearch snapshot is a backup of an index taken from a running cluster. Snapshots are taken incrementally. This means that when OpenSearch creates a snapshot of an index, it will not copy any data that was already backed up in an earlier snapshot of the index (unless it was changed). Therefore, it is recommended to take snapshots often.

You can restore snapshots into a running cluster via the restore API. Snapshots can only be restored to versions of OpenSearch that can read the indices. Check the version compatibility before you restore. You can’t restore an index to a cluster that is more than one version above the index version.

The following repository types are supported:

  • File system location
  • S3 object storage 
  • HDFS
  • Azure and Google Cloud storage


An example of using S3 repository for OpenSearch:

PUT _snapshot/backups
    "type": "s3",
    "settings": {
      "bucket": "opensearch",
      "endpoint": "",
      "protocol": "http"

You will also need to set the S3 access key and secret key in OpenSearch key store.

bin/opensearch-keystore add s3.client.default.access_key
bin/opensearch-keystore add s3.client.default.secret_key

Taking a snapshot

Once the repo is set, taking a snapshot is just an API call.

PUT /_snapshot/backup/my_snapshot-01-10-2019

Where backup is the name of snapshot repo, and my_snapshot-01-10-2019 is the name of the snapshot. The above example will take a snapshot of all the indices. To take a snapshot of specific indices, provide the names of the indices you would like a snapshot of. 

PUT /_snapshot/backup/my_snapshot-01-10-2019
  "indices": "my_index_1,my_index_2"

Restoring a snapshot

Restoring from a snapshot is also an API call:

POST /_snapshot/backup/my_snapshot-01-10-2019
  "indices": "index_1,index_2"

This will restore index_1 and index_2 from the snapshot my_snapshot-01-10-2019 in backup repository.

Notes and good things to know

  • Snapshot repository needs to be set up before you can take a snapshot, and you will need to install the S3 repository plugin as well if you plan to use a repository with S3 as backend storage.
sudo bin/opensearch-plugin install repository-s3
  • It is better to use OpenSearch snapshots instead of disk backups/snapshots. An index must be closed in order to be restored.
  • Another option is to delete the index before restoring it. The snapshot and restore mechanism can also be used to copy data from one cluster to another cluster.
  • If you don’t have S3 storage , you can run minio with NFS backend to create an S3 equivalent for your cluster snapshots
  • When the operation is retried, it will only try to snapshot any shards that failed on the initial operation, until the snapshot succeeds.
  • It is better to have the snapshot repo on the local network with OpenSearch or configure/design the repository for high write throughput so that you don’t have to deal with partial snapshots.
  • The snapshot operation will fail if there is a missing index. Setting the ignore_unavailable option to true will cause indices that do not exist to be ignored during snapshot operation. 
  • If you are using some open source security tool such as SearchGuard, you will need to configure the OpenSearch snapshot restore settings on the cluster before you can restore any snapshot. 
  • In opensearch.yml:
searchguard.enable_snapshot_restore_privilege: true

Create data backups automatically without using snapshots

If having backups of your data is important to you and your operations, snapshots may not be ideal for you. Firstly, there are the problems mentioned above, but you also run the risk of losing any data generated in the time elapsed since the last snapshot was stored.

If, for example, you designate a snapshot and restore process to occur every 5 minutes, the data being backed up is always 5 minutes behind. If a cluster fails 4 minutes after the last snapshot was taken, 4 minutes of data will be completely lost.

Additional notes

Elasticsearch and OpenSearch are both powerful search and analytics engines, but Elasticsearch has several key advantages. Elasticsearch boasts a more mature and feature-rich development history, translating to a better user experience, more features, and continuous optimizations. Our testing has consistently shown that Elasticsearch delivers faster performance while using fewer compute resources than OpenSearch. Additionally, Elasticsearch’s comprehensive documentation and active community forums provide invaluable resources for troubleshooting and further optimization. Elastic, the company behind Elasticsearch, offers dedicated support, ensuring enterprise-grade reliability and performance. These factors collectively make Elasticsearch a more versatile, efficient, and dependable choice for organizations requiring sophisticated search and analytics capabilities.

How helpful was this guide?

We are sorry that this post was not useful for you!

Let us improve this post!

Tell us how we can improve this post?