Snapshot and restore in Elasticsearch - Step-by-Step Execution

Concept Flow - Snapshot and restore

Create Snapshot Repository

↓

Take Snapshot

↓

Snapshot Stored Safely

↓

Restore Snapshot

↓

Data Restored to Cluster

The flow shows creating a place to save snapshots, taking a snapshot, storing it, and later restoring data from it.

Execution Sample

Elasticsearch

PUT /_snapshot/my_backup
{
  "type": "fs",
  "settings": {"location": "/mount/backups/my_backup"}
}

PUT /_snapshot/my_backup/snapshot_1?wait_for_completion=true

POST /_snapshot/my_backup/snapshot_1/_restore

This code creates a snapshot repository, takes a snapshot, and restores it to the cluster.

Execution Table

Step	Action	Request Sent	Response Status	Result
1	Create snapshot repository	PUT /_snapshot/my_backup with location setting	Acknowledged	Repository 'my_backup' created
2	Take snapshot	PUT /_snapshot/my_backup/snapshot_1?wait_for_completion=true	OK	Snapshot 'snapshot_1' saved in 'my_backup'
3	Restore snapshot	POST /_snapshot/my_backup/snapshot_1/_restore	Accepted	Data restored from 'snapshot_1'
4	End	No further requests	N/A	Snapshot and restore process complete

💡 All steps completed successfully; snapshot stored and restored.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
Repository 'my_backup'	Not created	Created	Created	Created	Created
Snapshot 'snapshot_1'	Not taken	Not taken	Taken	Taken	Taken
Cluster Data	Original data	Original data	Original data	Restored from snapshot	Restored data

Key Moments - 3 Insights

Why do we need to create a snapshot repository before taking a snapshot?

The repository is the storage location for snapshots. Without it, Elasticsearch doesn't know where to save the snapshot. See execution_table step 1.

What does the parameter 'wait_for_completion=true' do when taking a snapshot?

It makes the request wait until the snapshot finishes before responding, so you know when it's done. See execution_table step 2.

Does restoring a snapshot delete existing data in the cluster?

No, restoring merges or overwrites data from the snapshot but does not delete the entire cluster data. See execution_table step 3.

Visual Quiz - 3 Questions

Look at the execution_table, what is the response status after creating the snapshot repository?

A Error

B Acknowledged

C Accepted

D Timeout

💡 Hint

Check execution_table row 1, column 'Response Status'

At which step is the snapshot actually saved?

A Step 3

B Step 1

C Step 2

D Step 4

💡 Hint

Look at execution_table row 2, 'Result' column

If you skip creating the repository, what will happen when you try to take a snapshot?

A Snapshot will fail because repository does not exist

B Snapshot will be saved in default location

C Snapshot will be saved but cannot be restored

D Snapshot will be created but empty

💡 Hint

Refer to key_moments question about repository necessity and execution_table step 1

Concept Snapshot

Snapshot and restore in Elasticsearch:
- Create a snapshot repository (storage location)
- Take a snapshot to save cluster data
- Restore snapshot to recover data
- Use REST API calls: PUT for repo and snapshot, POST for restore
- 'wait_for_completion=true' waits for snapshot to finish

Full Transcript

This visual execution shows how Elasticsearch snapshot and restore works step-by-step. First, you create a snapshot repository, which is a place to store backups. Then you take a snapshot, which saves the current data state into that repository. Finally, you restore the snapshot to recover data. The execution table tracks each step's request, response, and result. Variables like repository status, snapshot status, and cluster data change as the process runs. Key moments clarify why the repository is needed, what 'wait_for_completion' means, and how restore affects data. The quiz tests understanding of these steps and their outcomes.

Practice

1. What is the main purpose of taking a snapshot in Elasticsearch?

easy

A. To save a backup of your data for recovery later

B. To speed up search queries

C. To delete old indexes automatically

D. To create new indexes from templates

Solution

1. Step 1: Understand snapshot purpose

   A snapshot in Elasticsearch is used to save a backup of your data at a point in time.

2. Step 2: Compare options

   Options B, C, and D describe other Elasticsearch features, not snapshot backup.

3. Final Answer:

   To save a backup of your data for recovery later -> Option A

4. Quick Check:

   Snapshot = Backup [OK]

Hint: Snapshots save data backups for recovery [OK]

Common Mistakes:

• Confusing snapshots with index templates
• Thinking snapshots speed up searches
• Assuming snapshots delete data

2. Which of the following is the correct syntax to create a snapshot repository in Elasticsearch?

easy

A. POST /_snapshot/my_backup {"type": "fs", "settings": {"location": "/mount/backups"}}

B. PUT /_snapshot/my_backup {"type": "fs", "settings": {"location": "/mount/backups"}}

C. GET /_snapshot/my_backup {"type": "fs", "settings": {"location": "/mount/backups"}}

D. DELETE /_snapshot/my_backup {"type": "fs", "settings": {"location": "/mount/backups"}}

Solution

1. Step 1: Identify correct HTTP method for creating repository

   Creating a snapshot repository uses the PUT method to define or update it.

2. Step 2: Check other methods

   POST is for creating snapshots, GET is for retrieving info, DELETE is for removing repositories.

3. Final Answer:

   PUT /_snapshot/my_backup {"type": "fs", "settings": {"location": "/mount/backups"}} -> Option B

4. Quick Check:

   Repository creation = PUT [OK]

Hint: Use PUT to create or update snapshot repositories [OK]

Common Mistakes:

• Using POST instead of PUT for repository creation
• Confusing GET with creation commands
• Trying to delete instead of create repository

3. Given this snapshot restore request:

POST /_snapshot/my_backup/snapshot_1/_restore
{
  "indices": "index1,index2",
  "rename_pattern": "index(.*)",
  "rename_replacement": "restored_index$1"
}

What will be the name of the restored index originally named index2?

medium

A. restored_index2

B. restored_index_index2

C. index2

D. index_restored2

Solution

1. Step 1: Understand rename_pattern and rename_replacement

   The pattern "index(.*)" captures the part after "index". The replacement "restored_index$1" adds "restored_index" plus the captured part.

2. Step 2: Apply to index2

   For "index2", the captured part is "2", so the new name is "restored_index2".

3. Final Answer:

   restored_index2 -> Option A

4. Quick Check:

   Rename pattern + replacement = restored_index2 [OK]

Hint: Captured group $1 appends after renamed prefix [OK]

Common Mistakes:

• Ignoring rename_pattern and keeping original name
• Adding extra 'index' in the replacement
• Misplacing the captured group in new name

4. You try to restore a snapshot but get an error: repository_missing_exception. What is the most likely cause?

medium

A. The snapshot name is incorrect

B. The cluster is running an incompatible Elasticsearch version

C. The snapshot repository does not exist or is not registered

D. The indices in the snapshot are corrupted

Solution

1. Step 1: Understand repository_missing_exception meaning

   This error means Elasticsearch cannot find the snapshot repository to access snapshots.

2. Step 2: Check other options

   Snapshot name errors cause different exceptions; corrupted indices cause restore failures but not repository missing; version mismatch causes other errors.

3. Final Answer:

   The snapshot repository does not exist or is not registered -> Option C

4. Quick Check:

   repository_missing_exception = missing repository [OK]

Hint: Check repository registration if repository_missing_exception occurs [OK]

Common Mistakes:

• Assuming snapshot name typo causes repository_missing_exception
• Blaming corrupted indices for repository errors
• Ignoring repository setup before restore

5. You want to restore only specific indexes from a snapshot but rename them to avoid conflicts. Which JSON snippet correctly does this during restore?

{
  "indices": "logs-2023,metrics-2023",
  "rename_pattern": "(.*)-2023",
  "rename_replacement": "$1-restore"
}

hard

A. Restores only logs-restore and metrics-restore indexes from snapshot

B. Restores logs-2023 and metrics-2023 with original names

C. Restores all indexes in snapshot renamed with -restore suffix

D. Restores logs-2023 and metrics-2023 as logs-restore and metrics-restore

Solution

1. Step 1: Analyze indices and rename_pattern

   Indices "logs-2023" and "metrics-2023" match the pattern "(.*)-2023" capturing "logs" and "metrics".

2. Step 2: Apply rename_replacement

   Replacement "$1-restore" changes names to "logs-restore" and "metrics-restore".

3. Step 3: Confirm only specified indices restored

   Only indices listed in "indices" are restored, renamed as specified.

4. Final Answer:

   Restores logs-2023 and metrics-2023 as logs-restore and metrics-restore -> Option D

5. Quick Check:

   Indices filtered + renamed correctly = Restores logs-2023 and metrics-2023 as logs-restore and metrics-restore [OK]

Hint: Use indices + rename_pattern/replacement to rename on restore [OK]

Common Mistakes:

• Restoring all snapshot indices ignoring filter
• Not using rename_pattern correctly
• Expecting renamed indexes to exist before restore