[ILM] Add support to delete index and searchable snapshot on different schedules

[a03nikki]

Description

Limitation

Currently, a user can configure ILM to delete the index from the Elasticsearch cluster but they only have the option to delete or keep the backing searchable snapshot.

From https://www.elastic.co/guide/en/elasticsearch/reference/current/ilm-delete.html#ilm-delete-options:

delete_searchable_snapshot

(Optional, Boolean) Deletes the searchable snapshot created in a previous phase. Defaults to true. This option is applicable when the searchable snapshot action is used in any previous phase.

If you set this option to false, use the Delete snapshots API to remove searchable snapshots from your snapshot repository when they are no longer needed.

If they choose false, then they are responsible for writing their own script for snapshot clean-up.

Ask

It would be useful if ILM had the option to set delete index to one value, e.g. 30 days, and delete the backing snapshot at another value, e.g. at 1 year.

This feature would help support longer retention periods required for compliance purposes where the day to day searching of the data is not required. For example, when an audit comes in, a user could manually "remount" the searchable snapshot indices as frozen indices for the time span required and duration of the process. However, during day to day operation, users only have access to a month of data by default.

[elasticsearchmachine]

Pinging @elastic/es-data-management (Team:Data Management)