Migrate your Elasticsearch data
Transitioning between Elastic deployment types involves migrating your Elasticsearch data. This page helps you plan your migration by describing the main categories of data you may need to move, the migration methods available for each, and where to find step-by-step guides for your scenario.
Your migration options depend on the type of data that you need to migrate, which can be categorized into four groups:
Ingested user data: All of the data that you've added into Elasticsearch, structured or unstructured, for your own applications.
Elasticsearch system data: Configuration and state stored in Elasticsearch system indices that supports core Elasticsearch platform operation—cluster coordination, engine-level services, and other internal metadata—rather than the settings, rules, or operational history tied to a specific Elastic feature or integration. That product-specific data is covered under Feature and component data.
Kibana saved objects: Dashboards, visualizations, maps, data views, Canvas workpads, and any other objects that you've saved in Kibana.
Feature and component data: Data stored in Elasticsearch that is specific to a given Elastic feature or component. This includes, for example, configuration data for Fleet and Integrations, Watcher data, alerting and security detection rules, security data such as role mappings, API keys, and service tokens, and others.
Depending on the type of data that you need to move, various migration options are available:
Not all migration methods are compatible with all deployment types. For your ingested user data, refer to the User data migration guides for more information before selecting a method.
| Migration method | Description |
|---|---|
| Reindex from source | For your own data, reindexing into your new, destination deployment from the data's original source is typically the most straightforward approach, because you don't need to consider differing Elasticsearch versions or deployment types. If you still have access to the original data source, outside of your former Elasticsearch cluster, you can load the data from there. You have the option to use any ingestion method that you want—Logstash, Elastic Agent, Beats, the Elasticsearch clients, or whatever works best for you. If the original source isn’t available or has other issues that make it non-viable, you can choose from one of the other migration options described here. |
| Dual ingest | For data with a limited lifecycle (logs and metrics, for example), another approach is to ingest into both the original and new environment at the same time, for a set duration. You can ingest into both environments for long enough for the data retention period to elapse. Then, after confirming that everything is working well in the new environment, the original environment can be shut down. |
| Snapshot and restore | Use a snapshot to create a backup of your running Elasticsearch cluster, and then migrate by restoring your data into a new cluster. Refer to Snapshot and restore for an overview and to Migrate Elasticsearch data using snapshots for step-by-step instructions to migrate your data. |
| Reindex API | Copy documents from a source index to a destination index. You can reindex across clusters and deployment types and transform the data en route. |
| Logstash | With Logstash you can collect, process, and forward data from a variety of sources to a variety of destinations. It serves as a highly configurable option available for migrating data between any deployment types. |
| Saved objects API | Use this API to migrate objects that you've saved in Kibana. |
| Kibana saved object management | You can also use the Kibana UI to migrate your saved objects. |
The following table describes the migration options available for each data type, and where to find guidance.
| Data type | Migration options |
|---|---|
| Ingested user data | The reindex API, snapshot and restore, and Logstash migration options are available for your user data, with some restrictions based on the source and target deployment type. Refer to User data migration guides on this page to learn more. |
| Elasticsearch system data | System indices must be migrated using the snapshot and restore feature states component. Refer to Migrate system indices for detailed migration steps. Migrating system data is not available when migrating to or from Serverless projects. |
| Kibana saved objects | Kibana saved objects can be migrated using the snapshot and restore feature states component or the Kibana import and export tools. The tools include the import and export endpoints of the Saved objects API and the import and export options in the Kibana UI. Snapshot and restore is generally the preferred migration method due to both speed and ease of use. |
| Elastic feature and component data | Configuration data for products such as Fleet, Integrations, and Watcher is typically migrated using the snapshot and restore feature. Refer to Snapshot and restore and to the documentation for each specific product for additional detail. In case you need to migrate Fleet configuration data through snapshot and restore, this requires also restoring the Kibana feature state. |
To migrate your Elasticsearch ingested user data, choose one of the available migration options depending on your source and target deployment types. The guides each use a specific source and target deployment type as an example, but they can all be adapted to your specific migration use case.
| From | To | Supported methods |
|---|---|---|
| ECH | ECH | Reindex API, Snapshot and restore, Logstash |
| ECE | ECH | Reindex API, Snapshot and restore, Logstash |
| ECK | ECH | Reindex API, Snapshot and restore, Logstash |
| Serverless | ECH | Reindex API, Logstash |
| Self-managed | ECH | Reindex API*, Snapshot and restore, Logstash |
* See also Reindex from a self-managed cluster using a private CA.
| From | To | Supported methods |
|---|---|---|
| ECH | ECE | Reindex API, Snapshot and restore, Logstash |
| ECE | ECE | Reindex API, Snapshot and restore, Logstash |
| ECK | ECE | Reindex API, Snapshot and restore, Logstash |
| Serverless | ECE | Reindex API, Logstash |
| Self-managed | ECE | Reindex API, Snapshot and restore, Logstash |
| From | To | Supported methods |
|---|---|---|
| ECH | ECK | Reindex API, Snapshot and restore, Logstash |
| ECE | ECK | Reindex API, Snapshot and restore, Logstash |
| ECK | ECK | Reindex API, Snapshot and restore, Logstash |
| Serverless | ECK | Reindex API, Logstash |
| Self-managed | ECK | Reindex API, Snapshot and restore, Logstash |
| From | To | Supported methods |
|---|---|---|
| ECH | Serverless | Reindex API
Logstash |
| ECE | Serverless | Logstash |
| ECK | Serverless | Logstash |
| Serverless | Serverless | Logstash |
| Self-managed | Serverless | Logstash |
| From | To | Supported methods |
|---|---|---|
| ECH | Self-managed | Reindex API, Snapshot and restore, Logstash |
| ECE | Self-managed | Reindex API, Snapshot and restore, Logstash |
| ECK | Self-managed | Reindex API, Snapshot and restore, Logstash |
| Serverless | Self-managed | Reindex API, Logstash |
| Self-managed | Self-managed | Reindex API, Snapshot and restore, Logstash |