Data Retention
For the retention of data for security and compliance, you can set LogScale to delete old data. Retention can be set in the user interface based on age of data. Retention deletes events in large chunks or segments. It doesn't delete individual events. Data is deleted when all events in a segment file are marked for deleting.
Retention is set on a repository basis; you can retain data in different repositories for different durations. Changes to these settings can be controlled on a repository basis through the role-based access control.
To view the data storage and compression, see Cluster statistics.
To learn how to change data retention settings, see Data Retention.
Age of Data
Data gets deleted when the latest event in the chunk is older than the configured retention. In order to make sure that a user cannot see events older than the configured limit, LogScale also restricts the time interval when searching to the interval allowed by this retention setting. Retention by age effectively hides any event that is too old, even if the chunk still has other events that are still visible. The disk space is reclaimed once the latest event is sufficiently old.