There are approximately 4,000 indices in Elasticsearch, all of which are in an open state. However, during the scheduled backup, only 1,660 indices were successfully backed up, while the remaining ones were ignored. Upon comparison, the key difference identified was the presence of ILM (Index Lifecycle Management) policies. Indices with ILM policies defined are not being included in the snapshot process.
Hello @Rajesh_Kannan
Could you please confirm if the daily snapshot backup is completed successfully?
If it is completed successfully & the indices with ILM policy attached is not backed up as part of this snapshot than could you please check the SLM policy? As if it is backed up via SLM policy than we need to check what is there in SLM policy because of which these indices are ignored.
Thanks!!
Hi @Tortoise The backup is completed succesfully, however there is no SLM policy defined in the Elasticsearch.
| Snapshot | Repository | Indices | Shards | Failed shards | Date created | Duration | Actions | |
|---|---|---|---|---|---|---|---|---|
| [snapshot-b-202507250405] snapshot-b-202507250405) | [backup-s3-repository] | 1270 | 1272 | 0 | Jul 25, 2025 9:35 AM GMT+5:30 | 72s | ||
Hello @Rajesh_Kannan
Thank you for the confirmation. Could you please share how the automatic Snapshot is scheduled as it is not via SLM?
Thanks!!
How is the snapshot backup being generated? You need a Snapshot policy to create the snapshots.
What do you have in Kibana when you go to Stack Management > Snapshot and Restore > Policies ? This should list your policies.
The sanpshots are taken through the curator jobs from the backend. When the ILM policies are removed those snapshots are included during the backup.
I believe Curator by default deliberately does not work on indices associated with ILM policies. As shown in the docs I linked to it is possible to override this default behaviour. I would recommend trying this, as I have not personally used this.
1 Like
Thanks for the help. It is working now.