Error adding snapshot to ISM Policy

Question

We have an AWS Managed OpenSearch cluster running 2.19 which we use to store logs. Each days logs are in a new index e.g. `main-2025-09-02.log`

We currently delete logs after 10 days.

```
{
    "policy": {
      "description": "Delete logs after 10 days",
      "default_state": "hot",
      "ism_template": [
        { "index_patterns": ["main-*"], "priority": 100 }
      ],
      "states": [
        {
          "name": "hot",
          "actions": [],
          "transitions": [
            { "state_name": "delete", "conditions": { "min_index_age": "10d" } }
          ]
        },
        {
          "name": "delete",
          "actions": [
            { "retry": { "count": 3, "backoff": "exponential", "delay": "1m" }, "delete": {} }
          ],
          "transitions": []
        }
      ]
    }
  }
```

This is working as expected. We now want to add a step to back them up to S3 before deleting. We have added the S3 bucket to Repositories in OpenSearch and did a Snapshot to ensure all permissions are working. I can see the .dat files in the S3 bucket.

However, trying to update the ISM policy is causing an issue

```
{
    "policy": {
      "description": "Send to S3 then delete after 10 days":,
      "default_state": "hot",
      "ism_template": [
        { "index_patterns": ["main-*"], "priority": 100 }
      ],
      "states": [
        {
          "name": "hot",
          "actions": [],
          "transitions": [
            { "state_name": "archive", "conditions": { "min_index_age": "10d" } }
          ]
        },
        {
          "name": "archive",
          "actions": [
            {
               "retry": {
               "count": 5,
               "backoff": "exponential",
               "delay": "30m"
            },
              "snapshot": {
                "repository": "main-app-logs-bucket",
                "snapshot": "{{ctx.index}}-{{ctx.execution_time}}"
              }
            }
          ],
          "transitions": [
            { "state_name": "delete" }
          ]
        },
        {
          "name": "delete",
          "actions": [
            { "retry": { "count": 3, "backoff": "exponential", "delay": "1m" }, "delete": {} }
          ],
          "transitions": []
        }
      ]
    }
  }
```

This get's an error saying

`You have actions that are not allowed in your policy [snapshot]`.

Looking at AWS RePost, the AWS AI bot, ChatGPT etc there doesn't seem to be concensus on what the issue is.

We do not have Fine-grained access control enabled.

I would rather not use SnapShot Management to automate snapshots as we want each index to be snapshotted once before being deleted (and allow us to reimport if required).

Would anyone have any suggestions?

re:Post Agent · Answer

The error you're encountering with the `snapshot` operation in your ISM policy is likely due to version requirements. The `snapshot` operation is only supported for domains running OpenSearch or Elasticsearch 7.7 or later.

Based on your policy structure, the issue appears to be with how you've formatted the `snapshot` action in your ISM policy. The `snapshot` action should be at the same level as the `retry` configuration, not nested within it. Here's how you should structure your policy:

```json
{
"policy": {
"description": "Send to S3 then delete after 10 days",
"default_state": "hot",
"ism_template": [
{ "index_patterns": ["main-*"], "priority": 100 }
],
"states": [
{
"name": "hot",
"actions": [],
"transitions": [
{ "state_name": "archive", "conditions": { "min_index_age": "10d" } }
]
},
{
"name": "archive",
"actions": [
{
"snapshot": {
"repository": "main-app-logs-bucket",
"snapshot": "{{ctx.index}}-{{ctx.execution_time}}",
"retry": {
"count": 5,
"backoff": "exponential",
"delay": "30m"
}
}
}
],
"transitions": [
{ "state_name": "delete" }
]
},
{
"name": "delete",
"actions": [
{ "delete": {}, "retry": { "count": 3, "backoff": "exponential", "delay": "1m" } }
],
"transitions": []
}
]
}
}
```

Note that in this corrected format:
1. The `retry` configuration is nested within the `snapshot` action, not the other way around
2. Similarly, in the delete state, the `retry` configuration should be part of the `delete` action

This structure aligns with how ISM expects the snapshot operation to be configured. Make sure your OpenSearch domain is running version 7.7 or later, as the snapshot operation is only supported from that version onward.  
**Sources**  
[Index State Management in Amazon OpenSearch Service - Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ism.html)

Error adding snapshot to ISM Policy

Ajoutez votre réponse

Contenus pertinents