# Unable to Configure SLM

**URL:** <https://discuss.elastic.co/t/unable-to-configure-slm/309132>\
**Category:** Elasticsearch\
**Tags:** slm-snapshot-lifecycle-management\
**Created:** [July 7, 2022, 4:42pm UTC](https://discuss.elastic.co/t/unable-to-configure-slm/309132 "2022-07-07T16:42:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mnchstrcityblues79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mnchstrcityblues79/32/108038_2.png) [@Mnchstrcityblues79](https://discuss.elastic.co/u/Mnchstrcityblues79)\
**Post date:** [July 7, 2022, 4:42pm UTC](https://discuss.elastic.co/t/unable-to-configure-slm/309132/1 "2022-07-07T16:42:12Z")

</div>

Greetings. I run the Graylog Open edition that uses ElasticSearch under the hood. Unfortunately, the archive feature is behind a paywall. Nonetheless, I need to backup my data and snapshots are the best way.

I have been following the instructions found here: [Create a snapshot | Elasticsearch Guide [8.3] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-take-snapshot.html#automate-snapshots-slm) (and the links contained therein) but have run into the following error when attempting to set the SLM policy:

```auto
curl -X PUT "localhost:9200/_slm/policy/daily-snapshots?pretty" -H 'Content-Type: application/json' -d @elastic_SLM_policy

```

Here is my @elastic\_SLM\_policy:

```auto
{  
  "schedule": "0 */12 * * * ?",  
  "name": "<every12h-snap-{now/d}>",  
  "repository": "my_fs_backup",  
  "config": {    
    "indices": "*",    
    "include_global_state": true  
  },  
  "retention": {    
    "expire_after": "90d",    
    "min_count": 5,    
    "max_count": 180  
  }
}

```

And I receive the following error:

```auto
{  
  "error" : {    
    "root_cause" : [      
      {        
        "type" : "index_not_found_exception",        
        "reason" : "no such index [_slm]",        
        "resource.type" : "index_expression",        
        "resource.id" : "_slm",        
        "index_uuid" : "_na_",        
        "index" : "_slm"      
      }    
    ],    
    "type" : "index_not_found_exception",    
    "reason" : "no such index [_slm]",    
    "resource.type" : "index_expression",    
    "resource.id" : "_slm",    
    "index_uuid" : "_na_",    
    "index" : "_slm"  
  }, "status" : 404 
}

```

Thank you for all your help!

---

<div class="post-metadata">

**Author:** ![Keith\_Massey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/keith_massey/32/83666_2.png) [@Keith\_Massey](https://discuss.elastic.co/u/Keith_Massey)\
**Post date:** [July 7, 2022, 5:21pm UTC](https://discuss.elastic.co/t/unable-to-configure-slm/309132/2 "2022-07-07T17:21:09Z")

</div>

What version of Elasticsearch is backing your Graylog? My guess is that it is a version that predates SLM?

---

<div class="post-metadata">

**Author:** ![Mnchstrcityblues79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mnchstrcityblues79/32/108038_2.png) [@Mnchstrcityblues79](https://discuss.elastic.co/u/Mnchstrcityblues79)\
**Post date:** [July 7, 2022, 5:28pm UTC](https://discuss.elastic.co/t/unable-to-configure-slm/309132/3 "2022-07-07T17:28:02Z")

</div>

I had not even thought about that:

````auto
{
  "name" : "graylog",
  "cluster_name" : "graylog",
  "cluster_uuid" : "<redacted>",
  "version" : {
    "number" : "7.10.2",
    "build_flavor" : "oss",
    "build_type" : "deb",
    "build_hash" : "<redacted>",
    "build_date" : "2021-01-13T00:42:12.435326Z",
    "build_snapshot" : false,
    "lucene_version" : "8.7.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}```
````

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 7, 2022, 5:37pm UTC](https://discuss.elastic.co/t/unable-to-configure-slm/309132/4 "2022-07-07T17:37:57Z")

</div>

> [@Mnchstrcityblues79](#):
>
> ```auto
> "number" : "7.10.2",
> "build_flavor" : "oss", <!--- OSS 
> 
> ```

The critical part is the `oss` SLM is / was part of X-Pack meaning you have to use the `default` distribution SLM is not in the `oss` distribution.

My Suggestion is Upgrade both Version to something newer like 7.17 and use the Basic / Free Forever license (there is no actual OSS distro after 7.10)

---

<div class="post-metadata">

**Author:** ![Mnchstrcityblues79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mnchstrcityblues79/32/108038_2.png) [@Mnchstrcityblues79](https://discuss.elastic.co/u/Mnchstrcityblues79)\
**Post date:** [July 7, 2022, 6:05pm UTC](https://discuss.elastic.co/t/unable-to-configure-slm/309132/5 "2022-07-07T18:05:38Z")

</div>

ah; that makes sense. The ironic part is that Graylog is not tested against anything higher than 7.10 (that I am aware of) but nonetheless recommends the using the snapshot api in elasticsearch [Backup - Configuring Graylog](https://docs.graylog.org/docs/backup)

Thank you for all your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2022, 6:06pm UTC](https://discuss.elastic.co/t/unable-to-configure-slm/309132/6 "2022-08-04T18:06:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.