We have setup ILM for our test environments so logs are deleted after 2 days.
Our QA workflow includes testing stuff on test branches and creating tickets for issues they encounter. They sometime put a link to Kibana where issue details can be seen in logs, helps with debugging. If a developer opens those logs after 4 days (so ILM deleted those logs already) is there a way to still see those logs?
So, if ILM deletes the logs after 2 days, is there a way to save some logs to last longer? Like saving discover search results? Do we need to take screenshots or export those logs?
Having ILM policy longer than 2 days seems inefficient since 95% of logs will never be used and like 1 % will be used even after 30 days.
Thanks,
Tadija