Closed indices are included in snapshot policy

We are using the elasticsearch 7.13.3 version using eck operator in our openshift cluster. When we are using below snapshot policy it did not include the closed indices in a snapshot.

PUT _slm/policy/elastic-snapshot { "name": "abc", "schedule": "xx xx * * * ?", "repository": "xyz", "config": { "ignore_unavailable": false, "include_global_state": false }, "retention": { "expire_after": "xxd", "min_count": x, "max_count": xxx } }

When we took a snapshot manually with below command it includes closed indices in a snapshot

PUT /_snapshot/xyz/manual-snapshot { "indices": "xxx-*", "expand_wildcards": "all" }

As per this github ticket this feature is backported to elasticsearch version 7.x Allow snapshotting replicated closed indices by ywelsch · Pull Request #39644 · elastic/elasticsearch · GitHub

How can we create a policy that creates snapshots that include closed indices in elasticsearch version 7.x

7.13 is really old, long past EOL, so you need to upgrade as a matter of some urgency. In supported versions there's no good reason to close indices, so you can avoid this problem by keeping all your indices open.

1 Like