Index snapshot doesn't work when using wildcard match

OpenSearch
1

Versions 2.9.0:

Describe the issue: No indices are included in the snapshot when using pattern match, but I explicitly list the indices, snapshot of all indices is successful.

Configuration:

Relevant Logs or Screenshots:

Creating Snapshot with pattern match

PUT /_snapshot/st1-audit-logs/vault_audit_2023_4
{
“indices”: “vault-audit-st1-2023.*”,
“ignore_unavailable”: true,
“include_global_state”: false,
“partial”: false
}

{
“snapshot”: “vault_audit_2023_4”,
“uuid”: “EeeUGHvXQGGVkcBpDdPApQ”,
“version_id”: 136307827,
“version”: “2.9.0”,
“remote_store_index_shallow_copy”: false,
“indices”: [ ],
“data_streams”: ,
“include_global_state”: false,
“state”: “SUCCESS”,
“start_time”: “2025-09-25T01:48:52.207Z”,
“start_time_in_millis”: 1758764932207,
“end_time”: “2025-09-25T01:48:52.407Z”,
“end_time_in_millis”: 1758764932407,
“duration_in_millis”: 200,
“failures”: ,
“shards”: {
“total”: 0,
“failed”: 0,
“successful”: 0
}

Creating Snapshot without pattern match

PUT /_snapshot/st1-audit-logs/vault_audit_2023_5
{
“indices”: “vault-audit-st1-2023.09.17,vault-audit-st1-2023.09.18,vault-audit-st1-2023.09.19”,
“ignore_unavailable”: true,
“include_global_state”: false,
“partial”: false
}

{
“snapshot”: “vault_audit_2023_5”,
“uuid”: “oL9mS3PaTkau1EU_d8Le6w”,
“version_id”: 136307827,
“version”: “2.9.0”,
“remote_store_index_shallow_copy”: false,
“indices”: [
“vault-audit-st1-2023.09.19”,
“vault-audit-st1-2023.09.18”,
“vault-audit-st1-2023.09.17”
],
“data_streams”: ,
“include_global_state”: false,
“state”: “SUCCESS”,
“start_time”: “2025-09-25T01:53:50.742Z”,
“start_time_in_millis”: 1758765230742,
“end_time”: “2025-09-25T01:53:58.545Z”,
“end_time_in_millis”: 1758765238545,
“duration_in_millis”: 7803,
“failures”: ,
“shards”: {
“total”: 3,
“failed”: 0,
“successful”: 3
}
}

2

@stecino I’m not able to reproduce this, are you using admin user for these actions?

Its possible other indices are getting picked up using this wildcard. Can you run the below command using admin certificate and key to see which indices are being picked up:

curl --cacert config/root-ca.pem --cert config/kirk.pem --key config/kirk-key.pem \
  "https://localhost:9200/_cat/indices/vault-audit-st1-2023.*?expand_wildcards=all&v"
3

It returns the indices

Screenshot 2025-09-25 at 9.36.31 AM
Screenshot 2025-09-25 at 9.36.31 AM1920×1045 183 KB

4

@stecino By default the snapshot expands to open indices, and in your case they are all closed, You can use the following snapshot command to include the closed indices:

PUT /_snapshot/os-fs-repo/snap-wild-3?wait_for_completion=true
{
  "indices": "vault-audit-st1-2023.*",
  "include_global_state": false,
  "expand_wildcards": "open,closed"
}
5

@Anthony It worked!! Thanks alot!