Create or update snapshot lifecycle policy APIedit

Creates or updates a snapshot lifecycle policy.


PUT /_slm/policy/<snapshot-lifecycle-policy-id>


If the Elasticsearch security features are enabled, you must have the manage_slm cluster privilege and the manage index privilege for any included indices to use this API. For more information, see Security privileges.


Use the create or update snapshot lifecycle policy API to create or update a snapshot lifecycle policy.

If the policy already exists, this request increments the policy’s version. Only the latest version of a policy is stored.

Path parametersedit

(Required, string) ID for the snapshot lifecycle policy you want to create or update.

Query parametersedit

(Optional, time units) Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error. Defaults to 30s.
(Optional, time units) Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error. Defaults to 30s.

Request bodyedit


(Required, object) Configuration for each snapshot created by the policy.

Properties of config

(Optional, string) Determines how wildcard patterns in the indices parameter match data streams and indices. Supports comma-separated values, such as closed,hidden. Defaults to open,hidden. Valid values are:

Match any data stream or index, including hidden ones.
Match open indices and data streams.
Match closed indices and data streams.
Match hidden data streams and indices. Must be combined with open, closed, or both.
Don’t expand wildcard patterns.
(Optional, Boolean) If false, the snapshot fails if any data stream or index in indices is missing or closed. If true, the snapshot ignores missing or closed data streams and indices. Defaults to false.

(Optional, Boolean) If true, include the cluster state in the snapshot. Defaults to true. The cluster state includes:


(Optional, string or array of strings) Comma-separated list of data streams and indices to include in the snapshot. Supports multi-index syntax. Defaults to an empty array ([]), which includes all data streams and indices, including system indices.

To exclude all data streams and indices, use -*.


(Optional, array of strings) Feature states to include in the snapshot. To get a list of possible feature state values and their descriptions, use the get features API. Each feature state includes one or more system indices.

If include_global_state is true, the snapshot includes all feature states by default. If include_global_state is false, the snapshot includes no feature states by default.

To exclude all feature states, regardless of the include_global_state value, specify an empty array ([]) or none.

(Optional, object) Attaches arbitrary metadata to the snapshot, such as a record of who took the snapshot, why it was taken, or any other useful data. Metadata must be less than 1024 bytes.

(Optional, Boolean) If false, the entire snapshot will fail if one or more indices included in the snapshot do not have all primary shards available. Defaults to false.

If true, allows taking a partial snapshot of indices with unavailable shards.

(Required, string) Name automatically assigned to each snapshot created by the policy. Date math is supported. To prevent conflicting snapshot names, a UUID is automatically appended to each snapshot name.
(Required, string) Repository used to store snapshots created by this policy. This repository must exist prior to the policy’s creation. You can create a repository using the snapshot repository API.

(Optional, object) Retention rules used to retain and delete snapshots created by the policy.

We recommend you include retention rules in your SLM policy to delete snapshots you no longer need. A snapshot repository can safely scale to thousands of snapshots. However, to manage its metadata, a large repository requires more memory on the master node. Retention rules ensure a repository’s metadata doesn’t grow to a size that could destabilize the master node.

Properties of retention
(Optional, time units) Time period after which a snapshot is considered expired and eligible for deletion. SLM deletes expired snapshots based on the slm.retention_schedule.
(Optional, integer) Maximum number of snapshots to retain, even if the snapshots have not yet expired. If the number of snapshots in the repository exceeds this limit, the policy retains the most recent snapshots and deletes older snapshots. This limit only includes snapshots with a state of SUCCESS.
(Optional, integer) Minimum number of snapshots to retain, even if the snapshots have expired.
(Required, Cron syntax) Periodic or absolute schedule at which the policy creates snapshots. SLM applies schedule changes immediately.


Create a daily-snapshots lifecycle policy:

PUT /_slm/policy/daily-snapshots
  "schedule": "0 30 1 * * ?", 
  "name": "<daily-snap-{now/d}>", 
  "repository": "my_repository", 
  "config": { 
    "indices": ["data-*", "important"], 
    "ignore_unavailable": false,
    "include_global_state": false
  "retention": { 
    "expire_after": "30d", 
    "min_count": 5, 
    "max_count": 50 

When the snapshot should be taken, in this case, 1:30am daily

The name each snapshot should be given

Which repository to take the snapshot in

Any extra snapshot configuration

Data streams and indices the snapshot should contain

Optional retention configuration

Keep snapshots for 30 days

Always keep at least 5 successful snapshots, even if they’re more than 30 days old

Keep no more than 50 successful snapshots, even if they’re less than 30 days old