Create or update snapshot lifecycle policy APIedit

Creates or updates a snapshot lifecycle policy.


PUT /_slm/policy/<snapshot-lifecycle-policy-id>


If the Elasticsearch security features are enabled, you must have the manage_slm cluster privilege and the manage index privilege for any included indices to use this API. For more information, see Security privileges.


Use the create or update snapshot lifecycle policy API to create or update a snapshot lifecycle policy.

If the policy already exists, this request increments the policy’s version. Only the latest version of a policy is stored.

Path parametersedit

(Required, string) ID for the snapshot lifecycle policy you want to create or update.

Query parametersedit

(Optional, time units) Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error. Defaults to 30s.
(Optional, time units) Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error. Defaults to 30s.

Request bodyedit


(Required, object) Configuration for each snapshot created by the policy.

Properties of config
(Optional, Boolean) If false, the snapshot fails if any data stream or index in indices is missing or closed. If true, the snapshot ignores missing or closed data streams and indices. Defaults to false.

(Optional, string) A comma-separated list of data streams and indices to include in the snapshot. Multi-index syntax is supported.

By default, a snapshot includes all data streams and indices in the cluster. If this argument is provided, the snapshot only includes the specified data streams and clusters.


(Optional, Boolean) If true, the current global state is included in the snapshot. Defaults to true.

The global state includes:

  • Persistent cluster settings
  • Index templates
  • Legacy index templates
  • Ingest pipelines
  • ILM lifecycle policies
  • Data stored in system indices, such as Watches and task records (configurable via feature_states)

(Optional, array of strings) A list of feature states to be included in this snapshot. A list of features available for inclusion in the snapshot and their descriptions be can be retrieved using the get features API. Each feature state includes one or more system indices containing data necessary for the function of that feature. Providing an empty array will include no feature states in the snapshot, regardless of the value of include_global_state.

By default, all available feature states will be included in the snapshot if include_global_state is true, or no feature states if include_global_state is false.

(Optional, object) Attaches arbitrary metadata to the snapshot, such as a record of who took the snapshot, why it was taken, or any other useful data. Metadata must be less than 1024 bytes.

(Optional, Boolean) If false, the entire snapshot will fail if one or more indices included in the snapshot do not have all primary shards available. Defaults to false.

If true, allows taking a partial snapshot of indices with unavailable shards.

(Required, string) Name automatically assigned to each snapshot created by the policy. Date math is supported. To prevent conflicting snapshot names, a UUID is automatically appended to each snapshot name.
(Required, string) Repository used to store snapshots created by this policy. This repository must exist prior to the policy’s creation. You can create a repository using the snapshot repository API.

(Optional, object) Retention rules used to retain and delete snapshots created by the policy.

Properties of retention
(Optional, time units) Time period after which a snapshot is considered expired and eligible for deletion. SLM deletes expired snapshots based on the slm.retention_schedule.

(Optional, integer) Maximum number of snapshots to retain, even if the snapshots have not yet expired. If the number of snapshots in the repository exceeds this limit, the policy retains the most recent snapshots and deletes older snapshots.

The maximum number of snapshots in a repository should not exceed 200. This ensures that the snapshot repository metadata does not grow to a size which might destabilize the master node. If the max_count setting is not set, this limit should be enforced by configuring other retention rules such that the repository size does not exceed 200 snapshots.

(Optional, integer) Minimum number of snapshots to retain, even if the snapshots have expired.
(Required, Cron syntax) Periodic or absolute schedule at which the policy creates snapshots. SLM applies schedule changes immediately.


Create a daily-snapshots lifecycle policy:

PUT /_slm/policy/daily-snapshots
  "schedule": "0 30 1 * * ?", 
  "name": "<daily-snap-{now/d}>", 
  "repository": "my_repository", 
  "config": { 
    "indices": ["data-*", "important"], 
    "ignore_unavailable": false,
    "include_global_state": false
  "retention": { 
    "expire_after": "30d", 
    "min_count": 5, 
    "max_count": 50 

When the snapshot should be taken, in this case, 1:30am daily

The name each snapshot should be given

Which repository to take the snapshot in

Any extra snapshot configuration

Data streams and indices the snapshot should contain

Optional retention configuration

Keep snapshots for 30 days

Always keep at least 5 successful snapshots, even if they’re more than 30 days old

Keep no more than 50 successful snapshots, even if they’re less than 30 days old