Behaviour when restoring over closed indicies

Elastic Stack Elasticsearch
1

I'm looking to understand the behaviour of Elasticsearch snapshot restore under differing circumstances. Try as I might I've been unable to find concrete answers.

  • I have two identical elastic search clusters. One is the primary and one is the standby.
  • I regularly take snapshots of the primary cluster and they are stored in a repo on an NFS share.
  • I restore a snapshot from the primary to the standby.
  • I restore the snapshot from the primary on the standby again a day later .. or even a month later.
  • I restore multiple times by closing the indices.

Questions:

  1. When I restore am I only getting the latest changes from the snapshot? It would seem the restore is much quicker the second time.
  2. How common is this practice and are there any edge cases I should know about?
  3. What happens if an index has changed since the last restore is it completely replaced or are only parts of it?
  4. What happens if the standby cluster has indices or objects in indices that no longer exist in the newest snapshot. Are they deleted and rewritten? Are only the files that don't exist in the snapshot removed? Are any objects or indices ever removed in a restore?
  5. In general how are diffs / conflicts handled in the restore process?

Thank you for any information you can provide.

2

Though it's quite old now (4 years!), this blog post is an excellent way to understand the fundamentals beneath snapshot/restore.


Please review and follow up if you find any of your questions still unanswered.

3

This article is helpful and i have had a look over it. It covers alot about repeated snapshot use. it only very lightly touches the topic of restoring over existing indices where it says that they must be closed. So it doesn't answer my questions primarily about restore above.

When I restore over closed indices that are either out of date or that have changed all together into a new cluster what happens to objects or indexes that are in the cluster but not the snapshot?

Is there ever a case where I restore a snapshot over closed indices and I end up with an index that is not representative of the original snapshot?

Mostly I need to understand.. when a cluster and a "standby cluster" diverge in unexpected ways like adding or removing indexes or objects how are all of those diffs resolved.

4

When you successfully restore an index from a snapshot, the state of the index after the restore is that it contains exactly the segments that were in the snapshot - no more, no less.
If there are segments on disk in the cluster that are part of the (closed) index of the same name that are not part of the named snapshot, they will no longer exist after the restore.
If there are segments on disk in the cluster that are part of the (closed) index of the same name that are part of the named snapshot, they will exist after the restore - without needing to have been copied again.
For this reason, we frequently refer to a snapshot as a "restore point".

I hope this helps!

2 Likes
5

Glen,
Thank you so much for clarifying this. This is exactly the disambiguation i needed.

6

Glad it was what you were looking for!

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.