Configure log data retention periods to balance storage costs with compliance and troubleshooting requirements.
Before you begin
Before you configure data retention, ensure you have:
- Administrative access to the LokiStack configuration
- Understanding of compliance requirements for log retention
- Knowledge of storage capacity and resource availability
- Access to the lokistack-chart repository
About this task
Data retention configuration determines how long logs are stored before they are deleted or archived. Increasing retention periods requires additional storage resources. The system provides insights on resource requirements to help you plan capacity effectively.
Procedure
-
Review the default data retention settings at Default retention configuration.
-
Check the existing retention periods for different log types (application logs, audit logs, system logs).
-
Determine the required retention periods based on your needs:
- Compliance requirements (regulatory mandates for log retention)
- Troubleshooting needs (how far back you need to investigate issues)
- Security audit requirements (incident investigation timeframes)
- Storage capacity constraints (available disk space and budget)
-
Calculate the storage resources needed for the new retention period.
-
Update the LokiStack configuration with the new retention settings.
Modify the retention period parameters in the configuration files according to the documentation guidelines.
-
Configure the audit log archive storage process.
Set up archival policies to move older logs to long-term storage while keeping recent logs in the active system.
-
Apply the configuration changes to the LokiStack deployment.
Use the appropriate deployment commands to update the running system with the new retention settings.
-
Monitor storage usage after implementing the new retention period.
Track disk usage, query performance, and system health to ensure the new settings work as expected.
-
Set up alerts for storage capacity thresholds.
Configure alerts to notify you when storage usage approaches capacity limits, allowing you to take action before running out of space.
Results
Data retention is configured according to your requirements, and the system provides adequate storage for the specified retention period.
Example
Example for tenant based retention configuration
logging:
tenants:
mode: openshift-logging
application:
retention:
days: 30
audit:
retention:
days: 60 # Audit logs retained for 60 days
infrastructure:
retention:
days: 30
What to do next
Regularly review retention settings and storage usage to ensure they continue to meet your needs. Adjust retention periods as requirements change or as storage capacity increases.