# Elastic Cloud warns when changing managed snapshot policy in Kibana

**URL:** <https://discuss.elastic.co/t/elastic-cloud-warns-when-changing-managed-snapshot-policy-in-kibana/359438>\
**Category:** Kibana\
**Created:** [May 14, 2024, 8:19am UTC](https://discuss.elastic.co/t/elastic-cloud-warns-when-changing-managed-snapshot-policy-in-kibana/359438 "2024-05-14T08:19:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tommed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tommed/32/132363_2.png) [@tommed](https://discuss.elastic.co/u/tommed)\
**Post date:** [May 14, 2024, 8:19am UTC](https://discuss.elastic.co/t/elastic-cloud-warns-when-changing-managed-snapshot-policy-in-kibana/359438/1 "2024-05-14T08:19:07Z")

</div>

We have an Elastic Cloud instance which uses the default "cloud-snapshot-policy" for back-ups. We had a separate service running in GCP which manages data retention which was misconfigured and trimmed 9 months of data which was supposed to be kept.

When we went to use the restore option in Kibana we noticed that back-ups are only kept for ~72hrs, meaning we have lost that data forever.

Our concern with this default is if something goes wrong Friday evening and it doesn't get picked up until Tuesday (say it's a bank holiday weekend) it will be too late.

Under Stack Management \> Data \> Snapshot and Restore \> Polices, I attempted to edit the "cloud-snapshot-policy" and change the back-up cron schedule to every hour (`0 0 */1 * * ?`) and under retention, change the "Delete After" to **3 days** and max. count to **200**. As I do so, I get the following warning:

> (!) This is a managed policy. Changing this policy might affect other systems that use it. Proceed with caution.

As I understand it, this policy is therefore managed by the Elastic Cloud infrastructure and I shouldn't change it? Given the aforementioned logic, how do we satisfy our risk in losing data? Additionally, does anyone have any experience in running Elastic Cloud with a much longer data retention period? Anything we should know/consider?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [May 14, 2024, 8:42am UTC](https://discuss.elastic.co/t/elastic-cloud-warns-when-changing-managed-snapshot-policy-in-kibana/359438/2 "2024-05-14T08:42:51Z")

</div>

Hi Tom,

The warning you're seeing is because the "cloud-snapshot-policy" is a managed policy, meaning it's used by the Elastic Cloud infrastructure. Modifying it could potentially affect other systems that use it.

However, you can create a new snapshot policy that suits your needs.

Regards

---

<div class="post-metadata">

**Author:** ![tommed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tommed/32/132363_2.png) [@tommed](https://discuss.elastic.co/u/tommed)\
**Post date:** [May 14, 2024, 9:44am UTC](https://discuss.elastic.co/t/elastic-cloud-warns-when-changing-managed-snapshot-policy-in-kibana/359438/3 "2024-05-14T09:44:48Z")

</div>

Hi @yago82,

Sure but having a separate policy would presumably create another duplication of the data and therefore eat into our storage capacity unnecessarily?

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [May 14, 2024, 10:04am UTC](https://discuss.elastic.co/t/elastic-cloud-warns-when-changing-managed-snapshot-policy-in-kibana/359438/4 "2024-05-14T10:04:37Z")

</div>

Hi,

You're correct that creating a new snapshot policy would create additional snapshots, which could increase your storage usage. However, it's important to note that Elasticsearch snapshots are incremental. This means that each snapshot only stores data that has changed since the last snapshot.

However, I believe there shouldn't be significant issues with increasing the retention period from 3 to 7 days, for example.

Regards

---

<div class="post-metadata">

**Author:** ![tommed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tommed/32/132363_2.png) [@tommed](https://discuss.elastic.co/u/tommed)\
**Post date:** [May 14, 2024, 10:30am UTC](https://discuss.elastic.co/t/elastic-cloud-warns-when-changing-managed-snapshot-policy-in-kibana/359438/5 "2024-05-14T10:30:24Z")

</div>

Ok thanks. That sounds like it may be the best option.
