Elasticsearch备份与恢复 #

快照特点
├── 增量备份
│   └── 只备份变更数据
├── 一致性
│   └── 保证数据一致性
├── 可恢复
│   └── 恢复到任意快照点
└── 跨集群
    └── 支持跨集群复制

快照流程
├── 1. 注册仓库
├── 2. 创建快照
├── 3. 验证快照
├── 4. 恢复快照
└── 5. 验证恢复

PUT /_snapshot/my_backup
{
  "type": "fs",
  "settings": {
    "location": "/mount/backups/my_backup",
    "compress": true
  }
}

PUT /_snapshot/s3_backup
{
  "type": "s3",
  "settings": {
    "bucket": "my-elasticsearch-backups",
    "region": "us-east-1",
    "base_path": "snapshots",
    "compress": true
  }
}

PUT /_snapshot/azure_backup
{
  "type": "azure",
  "settings": {
    "container": "backup-container",
    "base_path": "snapshots"
  }
}

PUT /_snapshot/gcs_backup
{
  "type": "gcs",
  "settings": {
    "bucket": "my-elasticsearch-backups",
    "base_path": "snapshots"
  }
}

GET /_snapshot

GET /_snapshot/my_backup

POST /_snapshot/my_backup/_verify

DELETE /_snapshot/my_backup

PUT /_snapshot/my_backup/snapshot_1?wait_for_completion=true

PUT /_snapshot/my_backup/snapshot_2
{
  "indices": "products,orders",
  "ignore_unavailable": true,
  "include_global_state": false
}

GET /_snapshot/my_backup/snapshot_1

GET /_snapshot/my_backup/_all

GET /_snapshot/my_backup/snapshot_1/_status

GET /_snapshot/my_backup/_status

DELETE /_snapshot/my_backup/snapshot_1

POST /_snapshot/my_backup/snapshot_1/_restore

POST /_snapshot/my_backup/snapshot_1/_restore
{
  "indices": "products",
  "ignore_unavailable": true,
  "include_global_state": false,
  "rename_pattern": "(.+)",
  "rename_replacement": "restored_$1"
}

GET /_recovery

GET /products/_recovery

DELETE /restored_products

PUT /_ilm/policy/snapshot_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_size": "50gb",
            "max_age": "1d"
          }
        }
      },
      "delete": {
        "min_age": "30d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

PUT /_slm/policy/nightly-snapshots
{
  "schedule": "0 30 1 * * ?",
  "name": "<nightly-snap-{now/d}>",
  "repository": "my_backup",
  "config": {
    "indices": ["*"],
    "ignore_unavailable": true,
    "include_global_state": false
  },
  "retention": {
    "expire_after": "30d",
    "min_count": 5,
    "max_count": 50
  }
}

POST /_slm/policy/nightly-snapshots/_execute

GET /_slm/policy

GET /_slm/status

PUT /_cluster/settings
{
  "persistent": {
    "cluster": {
      "remote": {
        "remote_cluster": {
          "seeds": ["remote_host:9300"]
        }
      }
    }
  }
}

PUT /_ccr/auto_follow/my_pattern
{
  "remote_cluster": "remote_cluster",
  "leader_index_patterns": ["products*"],
  "follow_index_pattern": "{{leader_index}}_follower"
}

GET /_ccr/stats

GET /_ccr/info

POST /products_follower/_ccr/pause_follow

POST /products_follower/_ccr/resume_follow

备份频率建议
├── 全量备份
│   └── 每周一次
├── 增量备份
│   └── 每天一次
├── 关键数据
│   └── 每小时一次
└── 配置备份
    └── 每次变更后

保留策略
├── 每日快照
│   └── 保留7天
├── 每周快照
│   └── 保留4周
├── 每月快照
│   └── 保留12月
└── 年度快照
    └── 保留3年

存储建议
├── 本地存储
│   └── 快速恢复
├── 云存储
│   └── 异地容灾
└── 多副本
    └── 多地存储

恢复测试
├── 每月测试
│   └── 验证快照可用性
├── 恢复演练
│   └── 模拟故障恢复
└── 文档记录
    └── 记录恢复步骤

GET /restored_products/_count

GET /restored_products/_search
{
  "query": { "match_all": {} }
}

备份建议
├── 自动化
│   └── 使用SLM自动备份
├── 多地存储
│   └── 异地容灾
├── 定期测试
│   └── 验证可恢复性
└── 监控告警
    └── 备份失败告警

恢复建议
├── 先验证快照
│   └── 检查快照完整性
├── 使用重命名
│   └── 避免覆盖现有数据
├── 分批恢复
│   └── 大索引分批处理
└── 验证数据
    └── 恢复后验证数据