Kibana snapshot policy from 5 days and indexes from one year

Elastic Stack Kibana
1

Hello,

I defined snapshot policy (for test purposes) to create snapshots from 5 days but I would like to have also indexes from last 5 days. Instead of that I have indexes there from one year.

How can I define snapshot policy for indexes from last 5 days ?

Here is my script:

PUT _slm/policy/daily-snapshots
{
"schedule": "0 5 9 * * ?",
"name": "<daily-snap-{now/d}>",
"repository": "my_repository",
"config":
{
"indices": "index-*",
"include_global_state": true
},
"retention":
{
"expire_after": "5d",
"min_count": 1,
"max_count": 5
}
}

by the way - I have a problem with understand min_count and max_count values.

Can someone explain it to me ?

Basically I need to have SLM for last 5 days and indexes from last 5 days also not all.

2

Hello @dominbdg

As part of SLM i do not think we can only create a snapshot for last 5 days of indices.

In your cluster you are keeping 1 year of indices of type index-* , so SLM will take backup of all index patterns.

Please find below documentation :

min_count number :
Minimum number of snapshots to retain, even if the snapshots have expired.

max_count number :
Maximum number of snapshots to retain, even if the snapshots have not yet expired. If the number of snapshots in the repository exceeds this limit, the policy retains the most recent snapshots and deletes older snapshots.

You might have to use an external script to extract indices of last 5 days & than pass that as part of indices parameter via API to take backup via SLM.

Thanks!!