Elasticsearch snapshots are incremental, meaning that when I create a snapshot for an index, Elasticsearch will look at the repository and search for other snapshots and if it finds another snapshot, it will only snapshot the delta between the previous snapshot and the one I'm currently taking.
So, here is the thing I don't understand:
- I create an index called 'events-2017.01.04' and insert 100 events to it.
- I take a snapshot called 'snapshot-2017.01.04-1'
- I insert another 100 events to the index.
- I take a second snapshot called 'snapshot-2017.01.04-2'
- I then delete the index and the first snapshot 'snapshot-2017.01.04-1'
- I restore the second snapshot 'snapshot-2017.01.04-2' (note: at this point this is the only snapshot in the repository)
- The index is restored and has 200 events in it.
I find this confusing, if the snapshot is incremental, shouldn't I only have 100 events in that index? The second snapshot was taken when the index had 200 events, but it should have only included 100 of them since the first snapshot had 100 events in it already.
What am I missing?