i want to understand how snapshot works in elasticsearch case1 snapshots are taken every day and snapshots older than 1 month are deleted I have an index cities and for example there are 3 documents { barcelona, ​​madrid, urumqi} and, for example, I deleted the barcelona document from the index, it turns out that if a month passes and the last snapshot in which this index was deleted, then I can no longer recover this document?

case2 I have an elasticsearch cluster and a fairly large number of indexes, the rotation is 3 months, if, for example, a couple of indexes change or all are deleted, then if I restore from a snapshot that was taken 3 months ago, will my cluster be fully restored 3 on months ago data? will snapshot process rewrite all data or not?

CodePudding user response：

1. if you delete the snapshots that cover an index then you cannot recover any of the data in the index. so no, you cannot recover the document
2. a restore will restore the data from the time the snapshot is taken. which means yes, the full data from 3 months will be what you see