Archiving

Fast, highly available storage is expensive. That means setting long retention times in Graylog or any other log management system can trigger serious cost constraints.

The good news is that, for the majority of use cases, you only need to perform instant log searches over a relatively short period of time. Many of our users want to keep 365 days of log data, but usually search over only the last 30 days..

With the Archiving functionality in Graylog Operations and Graylog Security, you can streamline operations by storing older data on slow storage and easily re-importing it into Graylog when you need it, simultaneously restore or delete multiple archives to quickly initiate extensive investigations for auditing requirements that require searching across a larger time range for compliance with HIPAA, PCI, or other requirements, or free up storage space to house new archives.

Also available in Graylog Operations, Graylog Security, and Graylog Open is Smart Indexing, a capability that eliminates the need to manually tune of your environment that can automatically adjust based on what is happening in your environment, instead of relying on the hit-or-miss manual process of tuning for averages.