# How to guarantee exact retention time for logs?

**URL:** <https://discuss.elastic.co/t/how-to-guarantee-exact-retention-time-for-logs/290056>\
**Category:** Elasticsearch\
**Tags:** ilm-index-lifecycle-management\
**Created:** [November 24, 2021, 11:44am UTC](https://discuss.elastic.co/t/how-to-guarantee-exact-retention-time-for-logs/290056 "2021-11-24T11:44:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kosodrom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kosodrom/32/99278_2.png) [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\
**Post date:** [November 24, 2021, 11:44am UTC](https://discuss.elastic.co/t/how-to-guarantee-exact-retention-time-for-logs/290056/1 "2021-11-24T11:44:11Z")

</div>

Hi folks,

I have following question:

I store logs in Elasticsearch cluster and want to guarantee the promised retention time of 30 days to the developer.

I have configured my Lifecycle policy to rollover after 30 days and then delete immediately. But this lead (obviously) to the situation that when the 30 days from rollover were reached - lets say - yesterday, the index will be deleted and the developer only sees logs from **1 day**.

One way to handle this would be to configure the policy to be always twice as much as the desired retention time. For example if you want to have the logs searchable for last 30 days you need to configure for example a rollover each 30 days and delete after 30 days. Am I correct?

Is there a more efficient way to guarantee to a developer a retention time of 30 days so he is always able to see the logs from _ **now 30 days back** _

Thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 24, 2021, 9:00pm UTC](https://discuss.elastic.co/t/how-to-guarantee-exact-retention-time-for-logs/290056/2 "2021-11-24T21:00:26Z")

</div>

Can you share your policy for this?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 25, 2021, 6:04am UTC](https://discuss.elastic.co/t/how-to-guarantee-exact-retention-time-for-logs/290056/3 "2021-11-25T06:04:35Z")

</div>

As ILM manages retention by deleting complete indices I would recommend setting the max time frame a single index covers to maximum one tenth of the total retention period. Having monthly indices with a 1 month retention period does not sound suitable.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2021, 6:04am UTC](https://discuss.elastic.co/t/how-to-guarantee-exact-retention-time-for-logs/290056/4 "2021-12-23T06:04:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.