ILM Delete Phase | A final Snapshot

[jugsofbeer]

When using ILM and using the Delete phase, we want to use the SLM functionality slightly differently to whats allowed.

We have one S3 repository for the regular 30minute snapshot of the entire deployment.
We have a second S3 repository that we want to use for final snapshots before the indice is deleted from the deployment, this is for long term storage | regulation reasons.

In the ILM delete phase we want choose an SLM repository that does a final full snapshot to the second S3 repository for the indices determined to be deleted and when the snapshot is successful it deletes the indice as expected.

We have tried an SLM policy in this scenario and using a cron doesnt make sense and theres no way to have the delete phase provide to the SLM policy the indices to snapshot.

The indices are filebeat and metricbeats based, usually daily rollovers.

As they get older say 2months after rollover, we want to keep the deployment to a certain level of performance and disk consumption, so a final snapshot and then delete keeps the deployment concise but also the final snapshot allows restoration if we ever needed to.

[elasticmachine]

Pinging @elastic/es-core-features (:Core/Features/ILM+SLM)

[dakrone]

We discussed this today and decided that this doesn't fit with the intended behavior of this action. Doing a one-off snapshot differs from the intended use from SLM. If this is something necessary a workaround can be using the searchable_snapshot action within ILM and then using delete_snapshot: false in the delete action which will keep the snapshot taken as part of the searchable snapshot step. We were also concerned that doing a on-demand snapshot for a single index would dramatically increase the number of snapshots and run into #74350 (which we are working on addressing)