Manage the snapshot lifecycleedit

You can set up snapshot lifecycle policies to automate the timing, frequency, and retention of snapshots. Snapshot policies can apply to multiple indices.

The snapshot lifecycle management (SLM) CRUD APIs provide the building blocks for the snapshot policy features that are part of the Management application in Kibana. The Snapshot and Restore UI makes it easy to set up policies, register snapshot repositories, view and manage snapshots, and restore indices.

You can stop and restart SLM to temporarily pause automatic backups while performing upgrades or other maintenance. To disable SLM entirely, set xpack.slm.enabled to false in elasticsearch.yml.

Security and SLMedit

Two built-in cluster privileges control access to the SLM actions when Elasticsearch security features are enabled:

manage_slm
Allows a user to perform all SLM actions, including creating and updating policies and starting and stopping SLM.
read_slm
Allows a user to perform all read-only SLM actions, such as getting policies and checking the SLM status.
cluster:admin/snapshot/*
Allows a user to take and delete snapshots of any index, whether or not they have access to that index.

For example, the following request configures an slm-admin role that grants the privileges necessary for administering SLM.

POST /_security/role/slm-admin
{
  "cluster": ["manage_slm", "cluster:admin/snapshot/*"],
  "indices": [
    {
      "names": [".slm-history-*"],
      "privileges": ["all"]
    }
  ]
}

Or, for a read-only role that can retrieve policies (but not update, execute, or delete them), as well as only view the history index:

POST /_security/role/slm-read-only
{
  "cluster": ["read_slm"],
  "indices": [
    {
      "names": [".slm-history-*"],
      "privileges": ["read"]
    }
  ]
}