Search and analytics for a storage systems

1. A computer-implemented method for evaluating application-level data in a secondary storage system storing backup data for a primary storage system, the method comprising:

retrieving, by execution of one or more processors, a first backup object of a plurality of backup objects stored in the secondary storage system, wherein each backup object in the plurality represents a storage state of the secondary storage system at a given point in time;

using the first backup object to perform a first level of reconstruction by reconstructing at least a portion of a full backup of a corresponding storage state associated with the first backup to obtain a reconstructed view of at least the portion of the full backup, wherein the first backup captures a snapshot since a previous backup using a B+ tree structure distributed among storage nodes of a distributed storage system;

performing a second level of reconstruction by reconstructing a first application object from at least the portion of the full backup reconstructed using the first backup object and the previous backup, wherein the first application object is nested in at least the portion of the full backup reconstructed using the first backup object, and the first level of reconstruction and the second level of reconstruction are performed to automatically and selectively access application level data encapsulated in at least the portion of the full backup reconstructed using the first backup object;

accessing the first application object according to a native application format associated with the first application object, wherein the first application object is accessed by identifying an application programming interface (API) associated with the first application object among a plurality of different application programming interfaces to identify the specifically identified application programming interface corresponding to a specific application level format of the first application object and invoking the identified application programming interface to interpret the first application object on an application level;

evaluating content stored by the first application object; and

modifying the first application object based on the evaluated content.

2. The method of claim 1 , wherein evaluating content stored by the first application object comprises:

identifying a second application object stored by the first application object; and

accessing the second application object stored by the first application object according to a native application format associated with the second application object.

3. The method of claim 2 , wherein modifying the first application object comprises:

identifying, based on the evaluation, specified content stored by the second application object; and

removing the specified content from the second application object.

4. The method of claim 2 , wherein accessing the second application object comprises:

invoking an application programming interface (API) associated with the second application object.

5. The method of claim 1 , wherein modifying the first application object comprises:

identifying, based on the evaluation, specified content stored by the first application object; and

removing the specified content from the first application object.

6. The method of claim 1 , further comprising:

building an index of content stored by the first application object.

7. The method of claim 1 , further comprising:

retrieving a second backup object of the plurality of backup objects stored in the secondary storage system;

reconstructing a second application object from the second backup object; and

replacing the first application object with the second application object in the first backup object.

8. A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to perform an operation for evaluating application-level data in a secondary storage system storing backup data for a primary storage system, the operation comprising:

retrieving a first backup object of a plurality of backup objects stored in the secondary storage system, wherein each backup object in the plurality represents a storage state of the secondary storage system at a given point in time;

using the first backup object to perform a first level of reconstruction by reconstructing at least a portion of a full backup of a corresponding storage state associated with the first backup to obtain a reconstructed view of at least the portion of the full backup, wherein the first backup captures a snapshot since a previous backup using a B+ tree structure distributed among storage nodes of a distributed storage system;

performing a second level of reconstruction by reconstructing a first application object from at least the portion of the full backup reconstructed using the first backup object and the previous backup, wherein the first application object is nested in at least the portion of the full backup reconstructed using the first backup object and the first level of reconstruction and the second level of reconstruction are performed to automatically and selectively access application level data encapsulated in at least the portion of the full backup reconstructed using the first backup object;

accessing the first application object according to a native application format associated with the first application object, wherein the first application object is accessed by identifying an application programming interface (API) associated with the first application object among a plurality of different application programming interfaces to identify the specifically identified application programming interface corresponding to a specific application level format of the first application object and invoking the identified application programming interface to interpret the first application object on an application level;

evaluating content stored by the first application object; and

modifying the first application object based on the evaluated content.

9. The computer-readable storage medium of claim 8 , wherein evaluating content stored by the first application object comprises:

identifying a second application object stored by the first application object; and

accessing the second application object stored by the first application object according to a native application format associated with the second application object.

10. The computer-readable storage medium of claim 9 , wherein modifying the first application object comprises:

identifying, based on the evaluation specified content stored by the second application object; and

removing the specified content from the second application object.

11. The computer-readable storage medium of claim 9 , wherein accessing the second application object comprises:

invoking an application programming interface (API) associated with the second application object.

12. The computer-readable storage medium of claim 8 , wherein modifying the first application object comprises:

identifying, based on the evaluation, specified content stored by the first application object; and

removing the specified content from the first application object.

13. A system comprising:

a processor; and

a memory storing program code, which, when executed on the processor performs an operation for evaluating application-level data in a secondary storage system storing backup data for a primary storage system, the operation comprising:

retrieving a first backup object of a plurality of backup objects stored in the secondary storage system, wherein each backup object in the plurality represents a storage state of the secondary storage system at a given point in time,

using the first backup object to perform a first level of reconstruction by reconstructing at least a portion of a full backup of a corresponding storage state associated with the first backup to obtain a reconstructed view of at least the portion of the full backup wherein the first backup captures a snapshot since a previous backup using a B+ tree structure distributed among storage nodes of a distributed storage system;

performing a second level of reconstruction by reconstructing a first application object from at least the portion of the full backup reconstructed using the first backup object and the previous backup, wherein the first application object is nested in at least the portion of the full backup reconstructed using the first backup object, and the first level of reconstruction and the second level of reconstruction are performed to automatically and selectively access application level data encapsulated in at least the portion of the full backup reconstructed using the first backup object;

accessing the first application object according to a native application format associated with the first application object, wherein the first application object is accessed by identifying an application programming interface (API) associated with the first application object among a plurality of different application programming interfaces to identify the specifically identified application programming interface corresponding to a specific application level format of the first application object and invoking the identified application programming interface to interpret the first application object on an application level;

evaluating content stored by the first application object, and

modifying the first application object based on the evaluated content.

14. The system of claim 13 , wherein evaluating content stored by the first application object comprises:

identifying a second application object stored by the first application object; and

accessing the second application object stored by the first application object according to a native application format associated with the second application object.

15. The system of claim 14 , wherein modifying the first application object comprises:

identifying, based on the evaluation, specified content stored by the second application object; and

removing the specified content from the second application object.

16. The system of claim 14 , wherein accessing the second application object comprises:

invoking an application programming interface (API) associated with the second application object.

17. The system of claim 13 , wherein the operation further comprises:

retrieving a second backup object of the plurality of backup objects stored in the secondary storage system;

reconstructing a second application object from the second backup object; and

replacing the first application object with the second application object in the first backup object.