Query about deleting snapshots

Elastic Stack Elasticsearch
1

I know that snapshots are incremental, but what I don't understand is what happens when you delete a snapshot? I assume that deleting an earlier snapshot will remove all indexes that have not been modified since it was taken from the backup??

My normal method of dealing with file backup is to maintain a daily, monthly, and yearly series. When you do a (successful) monthly you the restart the daily one, likewise for the year.

This cuts down the amount of work restoring in the case of disaster.

So I should have 3 repositories daily, monthly and yearly?

2

Snapshots are incremental behind the scene but you can think of a snapshot as a full backup.

Removing a snapshot has no impact on other snapshots.

3

Thanks David

so I don't need to go to elaborate length -- just do daily snapshots and keep the most recent few for redundancy. Correct?

what is the best way to archive data that I don't want immediate access to (I am using ILM).

4

Yes.

I'd recommend looking at SLM (Snapshot Lifecycle Management) feature.

5

Good! I have that set up in the snapshot policy - kibana. It is somewhat over engineered at the moment!

Thanks Again

6

Just letting @dadoonet know that we spotted this question coming up quite a bit so we recently clarified it in the manual:

Snapshots are also logically independent from each other, even within a single repository: deleting a snapshot does not affect the integrity of any other snapshot.

Also:

There isn't really a way to archive parts of a repository (e.g. less-recent snapshots) - a repository is basically a monolithic pile of data. It's something that comes up from time to time, and more so recently now that snapshots can now be made searchable. Out of interest, could you describe how you'd want to use such a feature?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.