Back up a cluster’s configurationedit
In addition to backing up the data in a cluster, it is important to back up its configuration—especially when the cluster becomes large and difficult to reconstruct.
Configuration information resides in
regular text files on every cluster node. Sensitive
setting values such as passwords for the Watcher notification servers, are
specified inside a binary secure container, the
elasticsearch.keystore file. Some setting values are
file paths to the associated configuration data, such as the ingest geo ip
database. All these files are contained inside the ES_PATH_CONF directory.
All changes to configuration files are done by manually editing the files or using command line utilities, but not through APIs. In practice, these changes are infrequent after the initial setup.
We recommend that you take regular (ideally, daily) backups of your Elasticsearch config
($ES_PATH_CONF) directory using the file backup software of your choice.
We recommend that you have a configuration management plan for these configuration files. You may wish to check them into version control, or provision them though your choice of configuration management tool.
Some of these files may contain sensitive data such as passwords and TLS keys, therefore you should investigate whether your backup software and/or storage solution are able to encrypt this data.
Some settings in configuration files might be overridden by
cluster settings. You can capture these settings in
a data backup snapshot by specifying the include_global_state: true (default)
parameter for the snapshot API. Alternatively, you can extract these
configuration values in text format by using the
get settings API:
GET _cluster/settings?pretty&flat_settings&filter_path=persistent
You can store the output of this as a file together with the rest of configuration files.
- Transient settings are not considered for backup.
- Elasticsearch security features store configuration data such as role definitions and API keys inside a dedicate special index. This "system" data, complements the security settings configuration and should be backed up as well.
- Other Elastic Stack components, like Kibana and Machine learning, store their configuration data inside other dedicated indices. From the Elasticsearch perspective these are just data so you can use the regular data backup process.