I'm looking to understand the behaviour of Elasticsearch snapshot restore under differing circumstances. Try as I might I've been unable to find concrete answers.
- I have two identical elastic search clusters. One is the primary and one is the standby.
- I regularly take snapshots of the primary cluster and they are stored in a repo on an NFS share.
- I restore a snapshot from the primary to the standby.
- I restore the snapshot from the primary on the standby again a day later .. or even a month later.
- I restore multiple times by closing the indices.
- When I restore am I only getting the latest changes from the snapshot? It would seem the restore is much quicker the second time.
- How common is this practice and are there any edge cases I should know about?
- What happens if an index has changed since the last restore is it completely replaced or are only parts of it?
- What happens if the standby cluster has indices or objects in indices that no longer exist in the newest snapshot. Are they deleted and rewritten? Are only the files that don't exist in the snapshot removed? Are any objects or indices ever removed in a restore?
- In general how are diffs / conflicts handled in the restore process?
Thank you for any information you can provide.