Searchable snapshot

Phases allowed: hot, cold, frozen.

Takes a snapshot of the managed index in the configured repository and mounts it as a searchable snapshot. If the index is part of a data stream, the mounted index replaces the original index in the stream.

The searchable_snapshot action requires data tiers. The action uses the index.routing.allocation.include._tier_preference setting to mount the index directly to the phase’s corresponding data tier. In the frozen phase, the action mounts a partially mounted index to the frozen tier. In other phases, the action mounts a fully mounted index to the corresponding data tier.

If the searchable_snapshot action is used in the hot phase the subsequent phases cannot include the shrink, forcemerge, or freeze actions.

This action cannot be performed on a data stream’s write index. Attempts to do so will fail. To convert the index to a searchable snapshot, first manually roll over the data stream. This creates a new write index. Because the index is no longer the stream’s write index, the action can then convert it to a searchable snapshot. Using a policy that makes use of the rollover action in the hot phase will avoid this situation and the need for a manual rollover for future managed indices.

By default, this snapshot is deleted by the delete action in the delete phase. To keep the snapshot, set delete_searchable_snapshot to false in the delete action.

PUT _ilm/policy/my_policy
{
  "policy": {
    "phases": {
      "cold": {
        "actions": {
          "searchable_snapshot" : {
            "snapshot_repository" : "backing_repo"
          }
        }
      }
    }
  }
}