Elasticsearch snapshot how it works

Elastic Stack Elasticsearch
1

i want to understand how snapshot works in elasticsearch case1 snapshots are taken every day and snapshots older than 1 month are deleted I have an index cities and for example there are 3 documents { barcelona, ​​madrid, urumqi} and, for example, I deleted the barcelona document from the index, it turns out that if a month passes and the last snapshot in which this index was deleted, then I can no longer recover this document?

case2 I have an elasticsearch cluster and a fairly large number of indexes, the rotation is 3 months, if, for example, a couple of indexes change or all are deleted, then if I restore from a snapshot that was taken 3 months ago, will my cluster be fully restored 3 on months ago data? will snapshot process rewrite all data or not?

2

If the oldest snapshot you have left was taken after the barcelona document was deleted this document can no longer be restored.

The snapshot captures a point in time. If you restore an index from a snapshot that was taken 3 months ago, any changes made since will no longer be available.

1 Like
3

so i restore my index with old content, and all new writes will be deleted right? sorry for my stupidness

4

Yes.

5

This is how backup works. Not only for Elasticsearch.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.