icon

Elasticsearch searchable snapshots

Search and store everything

Searchable snapshots transform the way you balance storage costs with search performance. Search across data in snapshots stored on AWS S3, Microsoft Azure Storage, and Google Cloud Storage, which can greatly reduce storage costs.

videoImage

Spin up Elasticsearch Service on Elastic Cloud with just a few clicks.

Try free

Dive into searchable snapshots documentation.

Read docs

Read more about our searchable snapshot announcement.

Read blog

Balance your storage costs

Time series data grows at an exponential rate. And as data becomes more of a differentiator to how your business and operations run, it can become expensive to store and search all your data. Data tiers, an integrated and automated way of managing the lifecycle of your data, can help you balance your storage costs.

illustration-balance-cost.png
illustration-balance-cost.png
illustration-life-cycles.png
illustration-life-cycles.png

Manage your data life cycle

Valuable data in Elasticsearch is stored in the hot tier for fast search queries. As data ages it loses importance and is searched less frequently, this data is moved to the warm tier consisting of lower cost, less performant compute and storage nodes. As data becomes less critical and read-only, it’s stored in snapshots on object storage such as S3. To search this data, however, requires a restore which isn’t immediately accessible for search.

Skip the manual restore

Introducing searchable snapshots a capability that brings S3 and other object stores to life: by allowing you to directly search the data stored in your snapshot. The cold tier utilizing searchable snapshots you can further reduce the cost of storage as much as half with a tradeoff on search performance. This is accomplished by separating the data used for resiliency from the data used for search, giving you the ability to balance storage costs and performance to fit your needs.

illustration-data-tiers.png
illustration-data-tiers.png
illustration-elastic-cloud.png
illustration-elastic-cloud.png

Get more from Elastic Cloud

If you’re using Elastic Cloud, you can use searchable snapshots to store more data at the same monthly spend. Get up and running quickly with templates and slider buttons to set and adjust storage capacity for each data tier.

Circle of life data

Explore the lifecycle of data in Elasticsearch using data tiers and searchable snapshots.

icon-quote

"I am really excited about new features in Elasticsearch — especially searchable snapshots. It is a common architecture design, storing snapshots to S3 as a cheap data backup. However, having this data searchable expands our options and could allow us to reduce the total cost of service.

Cold data with S3 replicas has the benefits of both, price and performance. In the future, I am looking forward to exploring the frozen tier for its usability and performance."

Marcel MatusCloud Services Development Manager, SAP Concur

Elastic solutions using searchable snapshots

Enterprise Search

Enterprise Search

Search across all of your application content and historical workplace records without breaking the bank by using searchable snapshots. Store more analytics data for marketing analysis, or test and release versioned application catalogs for new deployment strategies.
Observability

Observability

With searchable snapshots you no longer need to choose which log, metric, or apm data to delete to save money. Imagine having the ability to search year over year on application performance without needing to rehydrate your data from backup. Or gain increased insight by combining observability data with business intelligence or data from external sources for customer behaviors and trends.
Security

Security

Arm threat hunters and security analysts with years of high-volume security data sources made easily accessible through searchable snapshots. Collect additional security-related data — IDS, NetFlow, DNS, PCAP, or endpoint data — at greater scale and keep it accessible for longer than previously practical or economical.

Frozen tier is here

The frozen tier, now generally available, lets you search snapshots stored exclusively within S3 or your choice of other object store. The frozen tier unlocks up to 20 times as much data per node versus the hot and warm tiers. Imagine having the ability to directly search a nearly unlimited amount of data on demand — all while having the access and search performance you need at the lowest storage cost possible. Built with features like async search and background search, the frozen tier provides the best search experience for this class of storage.