Data Retention
For the retention of data for security and compliance, you can set LogScale to delete old data. You can configure retention settings in the user interface based on age of data. Retention deletes events in large chunks or segments. It doesn't delete individual events. Data is deleted when all events in a segment file are marked for deletion.
Retention is set on a repository basis; you can retain data in different repositories for different durations. Changes to these settings can be controlled on a per repository basis through the role-based access control.
To view the data storage and compression, see Cluster Statistics.
To learn how to change data retention settings, see Data Retention.
| Retention Type | Based On | Primary Use Case |
|---|---|---|
| Age of Data | Value of @timestamp field in events | Delete data older than a specified time period |
Age of Data
Data gets deleted when the latest event in the chunk is older than the configured retention using the value of the @timestamp field in the ingested data. To ensure that you cannot see events older than the configured limit, LogScale also restricts the time interval when searching to the interval allowed by this retention setting. Retention by age effectively hides any event that is too old, even if the chunk still has other events that are still visible. The disk space is reclaimed once the latest event is sufficiently old.