Please read the image for my question:
Hi austinsonger,
Generally, please ask the question with text, as images aren't indexed for other users searching that might have the same question.
To answer your question, if you use the delete phase within ILM, on the delete action itself is an option (delete_searchable_snapshot) that lets you choose whether to delete the snapshot when the index is deleted. By default the snapshot is deleted.
If you manually deleted the index with something like curl -XDELETE esserver:9200/myindex, then the snapshot would still remain.
1 Like
Okay so if I set it to forever and and delete the index manually, then the snapshot will still be searchable? I use Elastic for Security and keeping data is useful, but I also want to keep storage under control for hot and warm tier.
No, you don't need to do that. For a frozen tier searchable snapshot (a shared_cache storage type) the original index is removed when it is converted to a searchable snapshot. So as soon as the conversion is done the "local" disk will be freed, and all the queries will use the cache/repository.
For a cold phase searchable snapshot (which is a full_copy storage type), an entire copy is kept locally, but no replicas are kept in the cluster (because the repository provides the replicas).
You don't need to delete the original index when converting in either case, ILM takes care of that.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.