Data Retention and Expiration

Each repository within LogScale can be configured with a retention setting, defining either the amount of data to be stored, or the age of the information.

Retention and expiration of data operates as follows:

  • Events are deleted, oldest event first, as determined by the value of the @timestamp field.

  • Queries are limited to the age retention of the repository. For example, if retention has been set to 6 months, you cannot search for data older than 6 months.

  • Data is marked as unavailable as soon as the @timestamp is older than the configured retention.

  • Data is deleted and the space reclaimed on disk as soon as all events in a given segment are beyond the configured retention limit.

This approach limits the accessibility of the data, limits the range and timespan of the query, and subsequently the data that can be returned.

For more information, see Data Retention.