I'm new to ElasticSearch administration. From what I've gathered so far for snapshots is they are always incremental. My question is regarding snapshot retention. The documentation mentions that the snapshots can be configured to be deleted. I'm curious on how that works internally because I was thinking if one snapshot was deleted it would be impossible to recover the data since the data will never be duplicated in another snapshot.
I think this can answer your question:
Deleted test, the file _0, _1, _2 used by test2 would not be deleted. Only file _3 was deleted.
Would the data that was in file _3 be unable to be recovered then since test2 did not have any pointers to it?
the data in file_3 was not used by test2 and it can be deleted if you only retention test2 snapshot.
Oh so the older data that's in test3 would no longer be able to be recovered?
So you'd set the max retention equal to the max ILM policy date for the indices included in the snapshot?
Snapshot retention and Index retention , these are two different facets. This can help you get a closer look at Elasticsearch's snapshot and restore.
That was very helpful. So it appears that the _3 file would get merged into the test2 snapshot once the test snapshot was deleted since the _3 file was not in the test2 snapshot? That would enable that data to be restored.
The reason _3 file was not in the test2 snapshot is Merge operation in Elasticsearch.The log in _3 had been merged into _4 file when snapshot test2 was created.
Perfect! Thanks so much for your help. The merge part was what I was missing.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.