Currently, we have deployed elasticsearch in our kubernetes cluster where we have daily indices configured. Currently for multiple tenants we store logs in same index based on routing key. We have daily curator job which runs to create snapshot of the previous index. We were planning to have different snapshot created for each tenant. Is it possible to split index into multiple snapshots based on any query.
The retention policies for each tenant is different so were planning to separate out snapshots based on tenants. Any ideas how we can achieve this?