Engineering Team Rebuilds Elasticsearch Backup SOP After Near-Total Data Loss in 2026
A site reliability engineering team narrowly avoided catastrophic data loss during a production recovery incident in July 2026, exposing critical flaws in their Elasticsearch 7.17.x backup procedures. The team discovered that snapshots completing with a PARTIAL status — caused by node shutdowns, shard unavailability, or NFS filesystem issues — leave invisible data gaps that only surface after restoration. Their revised standard operating procedure now mandates that only snapshots with a SUCCESS status are acceptable, and that any partial snapshot triggers a fresh backup after resolving the underlying infrastructure issue. Additional lessons include excluding auto-generated system indices such as .tasks and .geoip_databases from restoration, and ensuring the source cluster shows green health before any snapshot is initiated. The team also adopted the practice of setting include_global_state to false, making snapshots fully portable and preventing configuration conflicts on the target cluster.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in