How to combine monthly multi-index snapshots (30 daily indices) with safe post-snapshot deletion in OpenSearch?

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.6

Hello everyone,

I am designing a backup and retention workflow in OpenSearch and need advice on the best architectural approach.

Our Setup & Requirements:

  • We have time-based indices with a strict naming convention: kuber-YYYY.MM.DD.*.
  • This generates exactly 30 daily indices per month.
  • Instead of running a separate snapshot for each individual daily index (which would create 30 separate snapshots a month and clutter our repository tracking), I want to group a whole month’s worth of indices into one single snapshot once a month.

The Desired Workflow (Example for April 1st):

  1. On April 1st, an automated job triggers.
  2. It targets all 30 daily indices from January (matching the pattern kuber-2026.01.*).
  3. It creates one comprehensive monthly snapshot named exactly kuber-2026.01.full.
  4. Only after the snapshot status is 100% SUCCESS, all these 30 January indices must be set to read_only and then permanently deleted from the cluster to free up space.

My Question:
Since native ISM (Index State Management) policies operate on a per-index level, it is tricky to coordinate a single snapshot for a group of 30 indices followed by their safe deletion.

What is the recommended way to implement this natively in OpenSearch? Should I look into Snapshot Management (SM) with dynamic date math, or is it better to orchestrate this via an external script (like a Cron job/Lambda calling the OpenSearch REST API)? If anyone has a working example or pattern for this specific workflow, I would appreciate your guidance!

Thank you!