What are the best practices for reading logs/data from cold or frozen data (more than 3, 6 or 12 months old)

I would like to explore the best practices to search frozen data. Can you please help me to understand all the available options and best approaches. Thanks.

Hi @parasavelli Welcome to the community.

That is a big request :slight_smile: there are many factor that can influence what is best for you.

What you put in each Tier Hot / Warm / Cold / Frozen is really up to your requirements.

But in short the new Cold and Frozen Tiers are very useful and a great TCO.

Frozen is an excellent choice for long term retention...

Searching happens seamlessly, searching Frozen is no different that searching on data that was just ingested... it may just take a bit longer... the first request may be longer and then with the advanced caching subsequent queries can be much faster.

I think the best / easiest way to experience all this is with Elastic Cloud with self managed there is definitely more setup configuration required.

First I would start with the basics understanding and read these blogs I would note we the Elastic move quickly so on all these where it say future they are all GA today.,


Thank you @stephenb.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.