Snapshot policy to include closed indices

Elastic Stack Elasticsearch
1

The create snapshot API states that the default for expand_wildcards is all, but our snapshots created through a snapshot policy does not include our closed indices.

We have tried with wildcards:

PUT _slm/policy/daily-snapshots
{
    "name": "<snapshot-{now/d}>",
    "schedule": "0 30 21 * * ?",
    "repository": "snapshots-001",
    "config": {
        "indices": ["*", ".*"]
    }
}

as well as without:

PUT _slm/policy/daily-snapshots
{
    "name": "<snapshot-{now/d}>",
    "schedule": "0 30 21 * * ?",
    "repository": "snapshots-001",
    "config": {}
}

In both cases our closed indices are not included.

How can we create a policy that creates snapshots that include closed indices?

2

Where do those docs say anything about expand_wildcards?

They do say this (emphasis mine)

By default, a snapshot includes all data streams and open indices in the cluster, as well as the cluster state.

I don't think we include closed indices in snapshots.

3

Sorry, for some reason I pasted the wrong url. This is the documentation that I meant to link:

This is the text:

The expand_wildcards option can be used to control whether hidden and closed indices will be included in the snapshot, and defaults to all .

4

Which version of Elasticsearch are you using? Looking at the documentation it looks like that description appeared for version Elasticsearch 7.7.

5

Apologies, yes, you're quite right, it's rather well-hidden in the code too but I see it now. I haven't had time to investigate further yet.

6

We're on 7.10.0.

7

As far as I can tell the newer docs are right and what I said before was wrong, we default "expand_wildcards":["open","closed","hidden"] which means all and definitely includes closed indices, and snapshots do include closed indices by default. I don't see anything in the SLM code that would change that. All very strange.

8

To check this in a more controlled manner I fired up a local Docker cluster from scratch with one Elasticsearch node and one Kibana instance running 7.10.1.

  1. I registered a repository and created a policy with default values.
PUT _slm/policy/daily-snapshots
{
  "name": "<snapshot-{now/d}>",
  "schedule": "0 0 0 1 1 ?",
  "repository": "snapshots",
  "config": {
    "include_global_state": true
  }
}
  1. I created an index
  2. I ran the policy => 8 indices in snapshot
  3. I closed the index that I created in step 2
  4. I ran the policy => 7 indices in snapshot

Screenshot 2020-12-17 at 16.55.13
Screenshot 2020-12-17 at 16.55.132352×808 102 KB

Any ideas on what to try with in order to get the closed indices included in the snapshots?

9

Thanks for reproducing it in a controlled fashion, that's very helpful. I suggest opening an issue on Github with this information, it sounds like a bug to me.

10

OK, here's what I know:

This command does not include closed:

POST /_snapshot/repo/snapshot

This command includes closed:

POST /_snapshot/repo/snapshot
{
  "expand_wildcards": "all"
}

I will create an issue on Github.

11
1 Like
12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.