Elasticsearch快照与S3仓库实践

概述目标：将索引数据按计划快照到S3仓库，并在故障/迁移时进行恢复，确保数据安全与可追溯。适用：日志索引备份、灾难恢复、跨环境迁移。核心与实战注册S3仓库：PUT _snapshot/logs_repo { "type": "s3", "settings": { "bucket": "es-snapshots", "region": "us-east-1", "base_path": "prod/logs", "role_arn": "arn:aws:iam::123456789012:role/es-snapshot-role" } } 创建快照：PUT _snapshot/logs_repo/snap-2025-11-26?wait_for_completion=true { "indices": "logs-*", "include_global_state": false } 查看快照与状态：GET _snapshot/logs_repo/_all GET _snapshot/logs_repo/snap-2025-11-26 恢复：POST _snapshot/logs_repo/snap-2025-11-26/_restore { "indices": "logs-000123", "rename_pattern": "logs-(.*)", "rename_replacement": "logs-restore-$1" } 示例安全与权限：-- 确保IAM角色具备S3读写与KMS权限（如启用加密） 定时任务：-- 使用外部调度（如CronJob）调用快照API，保留策略与删除旧快照 验证与监控仓库健康：GET _cat/repositories?v GET _cat/snapshots/logs_repo?v 成本与保留：观察S3存储占用与生命周期策略；删除过期快照降低成本。恢复校验：在非生产集群进行恢复演练，验证索引与别名一致性。常见误区包含全局状态导致集群设置被覆盖；通常关闭`include_global_state`。权限不足导致仓库注册或快照失败；需配置正确IAM策略与KMS权限。未做恢复演练；灾难时无法保证恢复成功与一致性。结语通过S3快照仓库与定期备份、演练恢复，Elasticsearch数据可实现可靠保护与跨环境迁移支持。