How Deleting Snapshots works?

[Bruce_Carey (Bruce)]

Hi All,

I have a question about snapshot behavior based on the following from the 5.02 docs:

"A snapshot can be deleted from the repository using the following command:
DELETE /_snapshot/my_backup/snapshot_1
When a snapshot is deleted from a repository, Elasticsearch deletes all files that are associated with the deleted snapshot and not used by any other snapshots."

It's the "and not used by any other snapshots" bit that I'm concerned with. If I choose to do incremental snapshots, instead of a new repo every day, this means that there's essentially a base file that contains the whole thing at the beginning. Assuming I only want to keep, say, 30 days of backup, how does the system behave when I tell it to delete the snapshot from the first day?

IE, does it merge the initial one into the one from the day after? Does the original FILE stay there but the entry in the list of snapshots doesn't show anymore?

Imagine I have a script that shows all available snapshots that I could restore from. Imagine that the initial backup contains "records" that are unchanged/used in all backups after that. What will my list look like after 60 days If each day, snapshots older than 30 days are "deleted"?

Thanks in advance!

[warkolm (Mark Walkom)]

As an example; If you have 100 shards in the first snapshot and then 100 in the last snapshot and 30 of those overlap, and if you then delete the first snapshot then 70 of the shards from the first snapshot will be deleted and the remainder 30 will be logically merged into the last snapshot.

When a snapshot is deleted, the files that are no longer needed are also deleted.