Elasticsearch snapshot how it works

i want to understand how snapshot works in elasticsearch case1 snapshots are taken every day and snapshots older than 1 month are deleted I have an index cities and for example there are 3 documents { barcelona, ​​madrid, urumqi} and, for example, I deleted the barcelona document from the index, it turns out that if a month passes and the last snapshot in which this index was deleted, then I can no longer recover this document?

case2 I have an elasticsearch cluster and a fairly large number of indexes, the rotation is 3 months, if, for example, a couple of indexes change or all are deleted, then if I restore from a snapshot that was taken 3 months ago, will my cluster be fully restored 3 on months ago data? will snapshot process rewrite all data or not?

If the oldest snapshot you have left was taken after the barcelona document was deleted this document can no longer be restored.

The snapshot captures a point in time. If you restore an index from a snapshot that was taken 3 months ago, any changes made since will no longer be available.

1 Like

so i restore my index with old content, and all new writes will be deleted right? sorry for my stupidness

Yes.

This is how backup works. Not only for Elasticsearch.

1 Like