# Snapshot for a complete beginner

**URL:** <https://discuss.elastic.co/t/snapshot-for-a-complete-beginner/299349>\
**Category:** Elasticsearch\
**Tags:** snapshot-and-restore\
**Created:** [March 10, 2022, 3:15pm UTC](https://discuss.elastic.co/t/snapshot-for-a-complete-beginner/299349 "2022-03-10T15:15:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Foggie](https://avatars.discourse-cdn.com/v4/letter/f/53a042/32.png) [@Foggie](https://discuss.elastic.co/u/Foggie)\
**Post date:** [March 10, 2022, 3:15pm UTC](https://discuss.elastic.co/t/snapshot-for-a-complete-beginner/299349/1 "2022-03-10T15:15:50Z")

</div>

I want to understand the relationship between the current "data" and snapshots. I am about to start work on a fairly small Elasticsearch application. At 2am each day a simple \_snapshot is performed to a repository with a file name parameter containing the current date/time. So each days snapshot is written to a new file. But is each of these files a complete copy or just incremental changes since yesterday?  
Also if the drive holding the active data crashes at 2pm have we lost 12 hours of new data?  
If the drive holding the snapshots glitches and one or more files holding snapshots is corrupted how much is lost.  
Sorry if this is answered elsewhere, but can't find this info in the documentation

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [March 10, 2022, 8:16pm UTC](https://discuss.elastic.co/t/snapshot-for-a-complete-beginner/299349/2 "2022-03-10T20:16:07Z")

</div>

> [@Foggie](#):
>
> But is each of these files a complete copy or just incremental changes since yesterday?

A snapshot isn't a single file, it's a whole collection of files. Each snapshot is a complete self-contained unit. See [these docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshot-restore.html#how-snapshots-work):

> Each snapshot is also logically independent. When you delete a snapshot, Elasticsearch only deletes the segments used exclusively by that snapshot. Elasticsearch doesn’t delete segments used by other snapshots in the repository.

> [@Foggie](#):
>
> Also if the drive holding the active data crashes at 2pm have we lost 12 hours of new data?

Yes. 24h is a long time to wait. Typically people take snapshots every 30 minutes, sometimes even more frequently.

> [@Foggie](#):
>
> If the drive holding the snapshots glitches and one or more files holding snapshots is corrupted how much is lost.

It depends how lucky you are, but potentially you could lose every snapshot. [Take a backup of your repository](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-register-repository.html#snapshots-repository-backup) to protect against this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 7, 2022, 8:16pm UTC](https://discuss.elastic.co/t/snapshot-for-a-complete-beginner/299349/3 "2022-04-07T20:16:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.