# Where data is stored? **URL:** \ **Category:** Elasticsearch\ **Created:** [August 26, 2017, 7:07am UTC](https://discuss.elastic.co/t/where-data-is-stored/98441 "2017-08-26T07:07:22Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [October 7, 2017, 7:43am UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/41 "2017-10-07T07:43:21Z")
OK, I changed them to "elasticsearch" and restart service and elasticsearch is running. I run commands and got: ```auto { "acknowledged": true } ``` Is it OK? If yes, Where is my backup? ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 9, 2017, 10:15pm UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/42 "2017-10-09T22:15:57Z")
Which command gave the `acknowledged: true`? The repository creation? ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [October 10, 2017, 7:39am UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/43 "2017-10-10T07:39:42Z")
```auto PUT /_snapshot/my_backup { "type": "fs", "settings": { "compress": true, "location": "/var/log/back-long/repo" } } ``` ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 10, 2017, 1:37pm UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/44 "2017-10-10T13:37:05Z")
You haven't created a snapshot yet. You've created a repository. When you perform a snapshot, you can now select `my_backup` as the repository. It will write data to `/var/log/back-long/repo`. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [October 10, 2017, 1:51pm UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/45 "2017-10-10T13:51:51Z")
How can I do it? ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 10, 2017, 1:59pm UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/46 "2017-10-10T13:59:43Z")
This was answered already in this very thread, [here](https://discuss.elastic.co/t/where-data-is-stored/98441/8?u=theuntergeek). ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [October 10, 2017, 2:50pm UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/47 "2017-10-10T14:50:40Z")
Excuse me, I'm a beginner. I did: ```auto GET /_snapshot/my_backup ``` And result is: ```auto { "my_backup": { "type": "fs", "settings": { "compress": "true", "location": "/var/log/back-long/repo" } } } ``` Then: ```auto curl -XPUT 'http://localhost:9200/_snapshot/my_backup' -H 'Content-Type: application/json' -d '{ "type": "fs", "settings": { "location": "/var/log/back-long/repo", "compress": true } }' ``` And result is: ```auto {"acknowledged":true} ``` Can you forward me to the right code? ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 10, 2017, 3:05pm UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/48 "2017-10-10T15:05:56Z")
While you can use the snapshot API to make snapshots, it can be easier in Curator. See the [snapshot action documentation](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/snapshot.html). There is also an [example configuration file](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/ex_snapshot.html). ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [October 10, 2017, 3:15pm UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/49 "2017-10-10T15:15:34Z")
I found it. I have written: ```auto PUT /_snapshot/my_backup/snapshot-number-one?wait_for_completion=true ``` And got: ```auto { "snapshot": { "snapshot": "snapshot-number-one", "uuid": "fsCaA1ZTSCWgvSMO7Ukz7A", "version_id": 5040199, "version": "5.4.1", "indices": [ "index_name-2017.10.02", "index_name-2017.10.03", "server2-2017.08.28", "beat-2017.10.02", "server1-2017.09.01", "server1-2017.08.28", ".kibana", "beat-2017.10.03" ], "state": "SUCCESS", "start_time": "2017-10-10T16:04:56.216Z", "start_time_in_millis": 1507651496216, "end_time": "2017-10-10T16:04:59.461Z", "end_time_in_millis": 1507651499461, "duration_in_millis": 3245, "failures": [], "shards": { "total": 36, "failed": 0, "successful": 36 } } } ``` And the content of the "repo" directory is: ```auto [root@localhost repo]# ls index-0 indices snap-fsCaA1ZTSCWgvSMO7Ukz7A.dat index.latest meta-fsCaA1ZTSCWgvSMO7Ukz7A.dat ``` Is it OK? ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 10, 2017, 3:33pm UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/50 "2017-10-10T15:33:52Z")
Yes. Here's why: > [@hack3rcon](#): > > "state": "SUCCESS", ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [October 10, 2017, 3:38pm UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/51 "2017-10-10T15:38:22Z")
Thank you. I created an archive from the directory and want to delete all data and restore it. Which command remove all indexes? ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 10, 2017, 4:09pm UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/52 "2017-10-10T16:09:50Z")
> [@hack3rcon](#): > > I created an archive from the directory What does that mean? I'm not sure what you are talking about. > [@hack3rcon](#): > > Which command remove all indexes? [With `DELETE /*` or `DELETE /_all`](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/indices-delete-index.html) ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [October 11, 2017, 10:31am UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/53 "2017-10-11T10:31:25Z")
I want to delete the indexes and restore it on another server. I did "curl -XDELETE '[http://localhost:9200/\_all](http://localhost:9200/_all)'" and I guess this command delete all indexes. I created a directory with the name "myback" under "/home/elastic/" and move archive file to there and extract it: ```auto [root@localhost myback]# tar -tf my-data.tar var/log/back-long/repo/ var/log/back-long/repo/meta-fsCaA1ZTSCWgvSMO7Ukz7A.dat var/log/back-long/repo/indices/ var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/ var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/meta-fsCaA1ZTSCWgvSMO7Ukz7A.dat var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/2/ var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/2/__0 var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/2/snap-fsCaA1ZTSCWgvSMO7Ukz7A.dat var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/2/index-0 var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/3/ var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/3/__0 var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/3/snap-fsCaA1ZTSCWgvSMO7Ukz7A.dat var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/3/index-0 var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/4/ var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/4/__0 var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/4/snap-fsCaA1ZTSCWgvSMO7Ukz7A.dat var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/4/index-0 var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/0/ var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/0/__0 var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/0/__1 var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/0/__2 var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/0/__3 var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/0/snap-fsCaA1ZTSCWgvSMO7Ukz7A.dat var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/0/index-0 var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/1/ var/log/back-long/repo/indices/plOVySQlQuGucWeH0EhMhA/1/__0 ... ``` then I changed the owner of directory to "elasticsearch": ```auto drwxr-xr-x. 2 elasticsearch elasticsearch 24 Oct 11 15:35 myback ``` After it, I opened the "elasticsearch.yml" file and added below line: ```auto path.repo: ["/home/elastic/myback/"] ``` Then I restart "elasticsearch" service, But I got an error: ```auto Caused by: java.nio.file.AccessDeniedException: /home/elastic/myback at sun.nio.fs.UnixException.translateToIOException(UnixException.java:84) ~[?:1.8.0_131] at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102) ~[?:1.8.0_131] at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107) ~[?:1.8.0_131] at sun.nio.fs.UnixFileSystemProvider.createDirectory(UnixFileSystemProvider.java:384) ~[?:1.8.0_131] at java.nio.file.Files.createDirectory(Files.java:674) ~[?:1.8.0_131] at java.nio.file.Files.createAndCheckIsDirectory(Files.java:781) ~[?:1.8.0_131] at java.nio.file.Files.createDirectories(Files.java:767) ~[?:1.8.0_131] at org.elasticsearch.bootstrap.Security.ensureDirectoryExists(Security.java:455) ~[elasticsearch-5.4.1.jar:5.4.1] at org.elasticsearch.bootstrap.Security.addPath(Security.java:411) ~[elasticsearch-5.4.1.jar:5.4.1] at org.elasticsearch.bootstrap.Security.addFilePermissions(Security.java:296) ~[elasticsearch-5.4.1.jar:5.4.1] at org.elasticsearch.bootstrap.Security.createPermissions(Security.java:224) ~[elasticsearch-5.4.1.jar:5.4.1] ``` Why? ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 11, 2017, 4:44pm UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/54 "2017-10-11T16:44:05Z")
> [@hack3rcon](#): > > I created a directory with the name "myback" under "/home/elastic/" and move archive file to there and extract it: This is not how this works. Snapshot and Restore are not archives in the traditional sense. You performed a snapshot, now to get the data back, you need to perform a restore. You cannot move files from a snapshot to another physical machine and expect Elasticsearch to just magically read them due to the metadata, node count, and several other conditions that cannot be predicted in a new, target cluster. Restore just pulls the shards out and creates new indices from the segments in the repository (the target index will have the same number of shards as the source at snapshot time). What this also means is that the cluster you're trying to restore to must also have read/write access to the shared filesystem defined in `path.repo`. This should not be an issue if you're restoring to the same cluster the snapshots came from. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [October 14, 2017, 6:59am UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/55 "2017-10-14T06:59:08Z")
I know that for restore it I need some commands. I created a directory and put backup on it for execute the next steps but as you see I got an error about permission. The directory name is `myback` and as you see elasticsearch has permission but it show me an error. How to solve it? Thank you. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [October 16, 2017, 11:43am UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/56 "2017-10-16T11:43:19Z")
What is your opinion? ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 17, 2017, 7:05am UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/57 "2017-10-17T07:05:30Z")
You have to create the exact same repository on both the source and target clusters. If they're the same, then you only need to issue the restore API call (or the restore action in Curator). The rest is just filling in the necessary bits as required by the API call (or action). ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [October 17, 2017, 7:30am UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/58 "2017-10-17T07:30:55Z")
Same location? What does it mean? For example, If on server 1 my backup located at "/var/log/back" then on server 2 for restore it I must create a directory with the name "back" under "/var/log" ? ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 17, 2017, 7:34am UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/59 "2017-10-17T07:34:48Z")
Both clusters must have the same repository configured using the exact same shared file path (i.e., both clusters need access to the same shared filesystem, and should have the same options configured). Once the repository is configured, it's roughly the same process as performing a snapshot. You specify the repository, not a path, and the snapshot you want to restore (and optionally, any indices you want to restore, or if not specified, all). ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [October 17, 2017, 7:42am UTC](https://discuss.elastic.co/t/where-data-is-stored/98441/60 "2017-10-17T07:42:23Z")
To be more clear, you need to do this on both clusters, and both must have access to `/var/log/back-long/repo`: > [@hack3rcon](#): > > ```auto > PUT /_snapshot/my_backup > { > "type": "fs", > "settings": { > "compress": true, > "location": "/var/log/back-long/repo" > } > } > > ``` [Previous page](https://discuss.elastic.co/t/where-data-is-stored/98441.md?page=2) [Next page](https://discuss.elastic.co/t/where-data-is-stored/98441.md?page=4)