# How to combine monthly multi-index snapshots (30 daily indices) with safe post-snapshot deletion in OpenSearch?

**URL:** <https://forum.opensearch.org/t/how-to-combine-monthly-multi-index-snapshots-30-daily-indices-with-safe-post-snapshot-deletion-in-opensearch/28303>\
**Category:** OpenSearch\
**Tags:** index-management\
**Created:** [September 29, 2026, 4:22pm UTC](https://forum.opensearch.org/t/how-to-combine-monthly-multi-index-snapshots-30-daily-indices-with-safe-post-snapshot-deletion-in-opensearch/28303 "2026-09-29T16:22:41Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![snap](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@snap](https://forum.opensearch.org/u/snap)\
**Post date:** [September 29, 2026, 4:22pm UTC](https://forum.opensearch.org/t/how-to-combine-monthly-multi-index-snapshots-30-daily-indices-with-safe-post-snapshot-deletion-in-opensearch/28303/1 "2026-09-29T16:22:41Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.6

Hello everyone,

I am designing a backup and retention workflow in OpenSearch and need advice on the best architectural approach.

**Our Setup & Requirements:**

- We have time-based indices with a strict naming convention: `kuber-YYYY.MM.DD.*`.
- This generates exactly **30 daily indices per month**.
- Instead of running a separate snapshot for each individual daily index (which would create 30 separate snapshots a month and clutter our repository tracking), I want to group a **whole month’s worth of indices** into **one single snapshot** once a month.

**The Desired Workflow (Example for April 1st):**

1. On **April 1st** , an automated job triggers.
2. It targets all 30 daily indices from January (matching the pattern `kuber-2026.01.*`).
3. It creates one comprehensive monthly snapshot named exactly `kuber-2026.01.full`.
4. **Only after the snapshot status is 100% SUCCESS** , all these 30 January indices must be set to `read_only` and then permanently deleted from the cluster to free up space.

**My Question:**  
Since native ISM (Index State Management) policies operate on a per-index level, it is tricky to coordinate a single snapshot for a group of 30 indices followed by their safe deletion.

What is the recommended way to implement this natively in OpenSearch? Should I look into **Snapshot Management (SM)** with dynamic date math, or is it better to orchestrate this via an external script (like a Cron job/Lambda calling the OpenSearch REST API)? If anyone has a working example or pattern for this specific workflow, I would appreciate your guidance!

Thank you!