Data Retention

For the retention of data for security and compliance, you can set LogScale to delete old data. Retention can be set in the web based user interface based on compressed file sizes, uncompressed file sizes, and on age of data. Retention deletes events in large chunks or segments. It doesn't delete individual events. The three types of retention enforced are independent — data is deleted when any one of them is marked for deleting.

Retention is set on a repository basis; you can retain data in different repositories for different durations. Changes to these settings can be controlled on a repostiory basis through the role-based access control.

Age of Data

Data gets deleted when the latest event in the chunk is older than the configured retention. In order to make sure that a user cannot see events older than the configured limit, LogScale also restricts the time interval when searching to the interval allowed by this retention setting. Retention by age effectively hides any event that is too old, even if the chunk still has other events that are still visible. The disk space is reclaimed once the latest event is sufficiently old.