> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/create-elasticsearch-snapshots.md). # Create Elasticsearch Snapshots We recommend scheduling regular automated snapshots of all indices. In addition, you can create a manual snapshot of some or all indices as needed. For example, you might want to create a manual snapshot of all indices before upgrading or making other significant changes. **Create Snapshot Repository** Before creating snapshots, register a [snapshot repository](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-register-repository.html) Example: ```screen PUT /_snapshot/xsoar_repository { "type": "fs", "settings": { "location": "xsoar_backup_location" } } ``` To enable cloud vendor repositories such as AWS S3 or Google Cloud Storage refer to the Elasticsearch Cloud documentation for [snapshot and restore with custom repositories](https://www.elastic.co/guide/en/cloud/current/ec-custom-repository.html) as an example of how to set up cloud vendor repositories. {% hint style="info" %} ### Note If you are using AWS Managed Elasticsearch, every Elasticsearch cluster is created with a default repository configured with a backend S3 bucket. {% endhint %} **Automated Snapshots** Automated snapshots can be scheduled using the Elasticsearch snapshot API to create a SLM (snapshot lifecycle management) policy. For more details about snapshot lifecycle management in Elasticsearch, see the [Elasticsearch SLM tutorial](https://www.elastic.co/guide/en/elasticsearch/reference/7.16/snapshots-take-snapshot.html#automate-snapshots-slm). In the following example, an incremental snapshot is created every hour and saved to the backup repository **`xsoar_repository`**. Each snapshot has a suffix with the current date timestamp. All active Cortex XSOAR indices are backed up, and 30 days of snapshots are retained. Snapshots older than 30 days are automatically deleted from the backup repository. ```screen PUT /_slm/policy/hourly-snapshots { "schedule": "0 0 * * * ? ?", "name": "", "repository": "xsoar_repository", "config": { "indices": ["*dmst-*"] }, "retention": { "expire_after": "30d", "min_count": 5 } } ``` **Manual Snapshots** Using the Elasticsearch snapshot API, you can create a snapshot of your database or specific indices to your selected repository (remote or local). You can specify the specific indices or use wildcards. Snapshots usually take only a few minutes to complete, depending on the number of indices and documents you are backing up. **Create a manual snapshot of one or more indices** The following example shows how to use the snapshot API to back up all of your 2020 indices. The snapshots are saved in the backup repository **`xsoar_repository`**. When creating the snapshot, you can provide a reason that will display in the snapshot metadata. ```programlisting PUT /_snapshot/xsoar_repository/year_2020_snapshot?wait_for_completion=true { "indices": ""dmst-*_2020*", "ignore_unavailable": true, "include_global_state": false, "metadata": { "taken_by": "me", "taken_because": "reason for backup" } } ``` The following example creates a snapshot to back up all of your 2021 incidents. The snapshots are saved in the backup repository **`xsoar_repository`**. When creating the snapshot, you can provide a reason that will display in the snapshot metadata. ```programlisting PUT /_snapshot/xsoar_repository/snapshotname?wait_for_completion=true { "indices": "*dmst-common-incident_2021*", "ignore_unavailable": true, "include_global_state": false, "metadata": { "taken_by": "me", "taken_because": "reason for backup" } } ``` The following example creates a snapshot **`snapshotname`** in repository **`xsoar_repository`** for all of the Cortex XSOAR data from September 2021. ```programlisting PUT /_snapshot/xsoar_repository/snapshotname?wait_for_completion=true { "indices": "*dmst-common-*_202109*", "ignore_unavailable": true, "include_global_state": false } ``` **Create a snapshot of the entire database** The following example API request creates a new snapshot named **`snapshotname`** in the repository **`xsoar_repository`**. The snapshot includes all Cortex XSOAR indices including cluster state like aliases, templates, etc. ```programlisting PUT /_snapshot/xsoar_repository/snapshotname?wait_for_completion=true { "indices": "*dmst*", "ignore_unavailable": true, "include_global_state": true } ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/elasticsearch/disaster-recovery-for-elasticsearch/create-elasticsearch-snapshots.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.