Searchable snapshots

The searchable snapshot feature incorporates techniques like caching frequently used data segments in cluster nodes and removing the least used data segment from the cluster nodes to make space for frequently used data segments. The data segments downloaded from snapshots on block storage reside alongside the general indexes of the cluster nodes. As such, the computing capacity of cluster nodes is shared between indexing, local search, and data segments on a snapshot residing on lower-cost object storage like Amazon Simple Storage Service (Amazon S3). While cluster node resources are utilized much more efficiently, the high number of tasks results in slower and longer snapshot searches. The local storage of the node is also used for caching the snapshot data.

If you’re running Docker, you can create a node with the search node role by adding the line - node.roles: [ search ] to your docker-compose.yml file:

To determine whether an index is a searchable snapshot index, look for a store type with the value of remote_snapshot:

• The ability to have a large number of searchable indexes in lower-cost media.

The following are known limitations of the searchable snapshots feature:

• Accessing data from a remote repository is slower than local disk reads, so higher latencies on search queries are expected.
• Searching remote data can impact the performance of other queries running on the same node. We recommend that users provision dedicated nodes with the search role for performance-critical applications.