# Repository for logs

**URL:** <https://discuss.elastic.co/t/repository-for-logs/179575>\
**Category:** Logstash\
**Created:** [May 3, 2019, 7:02pm UTC](https://discuss.elastic.co/t/repository-for-logs/179575 "2019-05-03T19:02:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![benqxf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benqxf/32/44352_2.png) [@benqxf](https://discuss.elastic.co/u/benqxf)\
**Post date:** [May 3, 2019, 7:02pm UTC](https://discuss.elastic.co/t/repository-for-logs/179575/1 "2019-05-03T19:02:22Z")

</div>

I receive about 2-3GB of weekly machine (software application) logs to troubleshoot. I'm in a limited budget and I am trying to learn Elasticsearch, Logstash, Filebeat how to store and archive these logs in a common repository and purge older logs based a date rules.

1. I'm trying to create a model (e.g. script) that allows to learn about the string patterns from these logs. The goal is to find root cause of the software application problem.  
I will appreciate your feedbacks. Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 4, 2019, 6:54am UTC](https://discuss.elastic.co/t/repository-for-logs/179575/2 "2019-05-04T06:54:31Z")

</div>

So you want to do automatic root cause analysis?

---

<div class="post-metadata">

**Author:** ![benqxf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benqxf/32/44352_2.png) [@benqxf](https://discuss.elastic.co/u/benqxf)\
**Post date:** [May 4, 2019, 1:48pm UTC](https://discuss.elastic.co/t/repository-for-logs/179575/3 "2019-05-04T13:48:30Z")

</div>

Hi @warkolm. Automatic Root cause analysis would be nice. But I am first concerned of the disk or repo for the logs since I receive about 2-3GB weekly.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 4, 2019, 8:45pm UTC](https://discuss.elastic.co/t/repository-for-logs/179575/4 "2019-05-04T20:45:43Z")

</div>

What's your concern though?

---

<div class="post-metadata">

**Author:** ![benqxf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benqxf/32/44352_2.png) [@benqxf](https://discuss.elastic.co/u/benqxf)\
**Post date:** [May 4, 2019, 11:18pm UTC](https://discuss.elastic.co/t/repository-for-logs/179575/5 "2019-05-04T23:18:39Z")

</div>

the cost of the disk space as I'm concerned since I receive 2-3 GB log file size weekly. How can I reduce the cost? Ideas?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 5, 2019, 1:18am UTC](https://discuss.elastic.co/t/repository-for-logs/179575/6 "2019-05-05T01:18:17Z")

</div>

That's not a lot though, so unless you budget is a few dollars a month then you might be worrying about the wrong thing.

If it's a big problem, then look at using `_rollup`, or only keeping a few days of data around.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2019, 1:18am UTC](https://discuss.elastic.co/t/repository-for-logs/179575/7 "2019-06-02T01:18:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.