# Delete (or retain) specific documents from ILM-frozen searchable snapshot **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management\ **Created:** [December 20, 2023, 8:54am UTC](https://discuss.elastic.co/t/delete-or-retain-specific-documents-from-ilm-frozen-searchable-snapshot/349698 "2023-12-20T08:54:30Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![maxboone](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxboone/32/130187_2.png) [@maxboone](https://discuss.elastic.co/u/maxboone)\ **Post date:** [December 20, 2023, 8:54am UTC](https://discuss.elastic.co/t/delete-or-retain-specific-documents-from-ilm-frozen-searchable-snapshot/349698/1 "2023-12-20T08:54:30Z")
Hey ELKers, We're running logging through Elastic but weren't very specific on our log indexes and had Elastic Agent pump all the logs in `logs-kubernetes.container_logs`. Most of these logs have by now rotated through to the frozen tier and are stored as a searchable snapshot. I don't want to delete the full snapshots for these logs but retain certain documents. I've tried (1) restoring the snapshot and doing a DeleteByQuery, (2) moving the index back to warm / hot using the Move to lifecycle step API, (3) reindexing the documents from the snapshot, deleting the snapshot. Probably the latter is the way to go, but I can't seem to get it to work using the docs - as these don't really mention snapshots or frozen indices (frozen being ILM-tier frozen, not the deprecated frozen index). What's a good course of action here? Regards, Max. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 17, 2024, 8:54am UTC](https://discuss.elastic.co/t/delete-or-retain-specific-documents-from-ilm-frozen-searchable-snapshot/349698/2 "2024-01-17T08:54:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.