Create or update snapshot lifecycle policy APIedit

Creates or updates a snapshot lifecycle policy.


PUT /_slm/policy/<snapshot-lifecycle-policy-id>


If the Elasticsearch security features are enabled, you must have the manage_slm cluster privilege and the manage index privilege for any included indices to use this API. For more information, see Security privileges.


Use the create or update snapshot lifecycle policy API to create or update a snapshot lifecycle policy.

If the policy already exists, this request increments the policy’s version. Only the latest version of a policy is stored.

Path parametersedit

(Required, string) ID for the snapshot lifecycle policy you want to create or update.

Query parametersedit

(Optional, time units) Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error. Defaults to 30s.
(Optional, time units) Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error. Defaults to 30s.

Request bodyedit


(Required, object) Configuration for each snapshot created by the policy.

Properties of config

(Optional, string) Determines how wildcard patterns in the indices parameter match data streams and indices. Supports comma-separated values, such as open,hidden. Defaults to all. Valid values are:

Match any data stream or index, including hidden ones.
Match open indices and data streams.
Match closed indices and data streams.
Match hidden data streams and indices. Must be combined with open, closed, or both.
Don’t expand wildcard patterns.
(Optional, Boolean) If false, the snapshot fails if any data stream or index in indices is missing or closed. If true, the snapshot ignores missing or closed data streams and indices. Defaults to false.

(Optional, Boolean) If true, include the cluster state in the snapshot. Defaults to true. The cluster state includes:


(Optional, string or array of strings) Comma-separated list of data streams and indices to include in the snapshot. Supports multi-target syntax. Defaults to an empty array ([]), which includes all regular data streams and regular indices. To exclude all data streams and indices, use -*.

You can’t use this parameter to include or exclude system indices or system data streams from a snapshot. Use feature_states instead.


(Optional, array of strings) Feature states to include in the snapshot. To get a list of possible values and their descriptions, use the get features API.

If include_global_state is true, the snapshot includes all feature states by default. If include_global_state is false, the snapshot includes no feature states by default.

Note that specifying an empty array will result in the default behavior. To exclude all feature states, regardless of the include_global_state value, specify an array with only the value none (["none"]).

(Optional, object) Attaches arbitrary metadata to the snapshot, such as a record of who took the snapshot, why it was taken, or any other useful data. Metadata must be less than 1024 bytes.

(Optional, Boolean) If false, the entire snapshot will fail if one or more indices included in the snapshot do not have all primary shards available. Defaults to false.

If true, allows taking a partial snapshot of indices with unavailable shards.

(Required, string) Name automatically assigned to each snapshot created by the policy. Date math is supported. To prevent conflicting snapshot names, a UUID is automatically appended to each snapshot name.
(Required, string) Repository used to store snapshots created by this policy. This repository must exist prior to the policy’s creation. You can create a repository using the snapshot repository API.

(Optional, object) Retention rules used to retain and delete snapshots created by the policy.

Properties of retention
(Optional, time units) Time period after which a snapshot is considered expired and eligible for deletion. SLM deletes expired snapshots based on the slm.retention_schedule.
(Optional, integer) Maximum number of snapshots to retain, even if the snapshots have not yet expired. If the number of snapshots in the repository exceeds this limit, the policy retains the most recent snapshots and deletes older snapshots. This limit only includes snapshots with a state of SUCCESS.
(Optional, integer) Minimum number of snapshots to retain, even if the snapshots have expired.
(Required, Cron syntax) Periodic or absolute schedule at which the policy creates snapshots. SLM applies schedule changes immediately.


Create a daily-snapshots lifecycle policy:

PUT /_slm/policy/daily-snapshots
  "schedule": "0 30 1 * * ?", 
  "name": "<daily-snap-{now/d}>", 
  "repository": "my_repository", 
  "config": { 
    "indices": ["data-*", "important"], 
    "ignore_unavailable": false,
    "include_global_state": false
  "retention": { 
    "expire_after": "30d", 
    "min_count": 5, 
    "max_count": 50 

When the snapshot should be taken, in this case, 1:30am daily

The name each snapshot should be given

Which repository to take the snapshot in

Any extra snapshot configuration

Data streams and indices the snapshot should contain

Optional retention configuration

Keep snapshots for 30 days

Always keep at least 5 successful snapshots, even if they’re more than 30 days old

Keep no more than 50 successful snapshots, even if they’re less than 30 days old