# What are the best practices for reading logs/data from cold or frozen data (more than 3, 6 or 12 months old)

**URL:** <https://discuss.elastic.co/t/what-are-the-best-practices-for-reading-logs-data-from-cold-or-frozen-data-more-than-3-6-or-12-months-old/288167>\
**Category:** Elasticsearch\
**Created:** [November 1, 2021, 6:34pm UTC](https://discuss.elastic.co/t/what-are-the-best-practices-for-reading-logs-data-from-cold-or-frozen-data-more-than-3-6-or-12-months-old/288167 "2021-11-01T18:34:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![parasavelli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parasavelli/32/96601_2.png) [@parasavelli](https://discuss.elastic.co/u/parasavelli)\
**Post date:** [November 1, 2021, 6:34pm UTC](https://discuss.elastic.co/t/what-are-the-best-practices-for-reading-logs-data-from-cold-or-frozen-data-more-than-3-6-or-12-months-old/288167/1 "2021-11-01T18:34:32Z")

</div>

I would like to explore the best practices to search frozen data. Can you please help me to understand all the available options and best approaches. Thanks.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 1, 2021, 8:13pm UTC](https://discuss.elastic.co/t/what-are-the-best-practices-for-reading-logs-data-from-cold-or-frozen-data-more-than-3-6-or-12-months-old/288167/2 "2021-11-01T20:13:04Z")

</div>

Hi @parasavelli Welcome to the community.

> [@parasavelli](#):
>
> **all** the available options and best approaches

That is a big request 🙂 there are many factor that can influence what is best for you.

What you put in each Tier Hot / Warm / Cold / Frozen is really up to your requirements.

But in short the new Cold and Frozen Tiers are very useful and a great TCO.

Frozen is an _ **excellent** _ choice for long term retention...

Searching happens seamlessly, searching Frozen is no different that searching on data that was just ingested... it may just take a bit longer... the first request may be longer and then with the advanced caching subsequent queries can be much faster.

I think the best / easiest way to experience all this is with [Elastic Cloud](https://cloud.elastic.co) with self managed there is definitely more setup configuration required.

First I would start with the basics understanding and read these blogs I would note we the Elastic move quickly so on all these where it say future they are all GA today.,

> **[Directly search S3 with the new frozen tier](https://www.elastic.co/blog/introducing-elasticsearch-frozen-tier-searchbox-on-s3)**
>
> In 7.12, we’re thrilled to be releasing the technical preview of the frozen tier, a feature that allows you to search object stores like S3 directly so you can store and search an unlimited amount of data at the lowest cost possible.

> **[Introducing Elasticsearch searchable snapshots](https://www.elastic.co/blog/introducing-elasticsearch-searchable-snapshots)**
>
> In 7.10, we’re thrilled to be releasing the beta of searchable snapshots, a feature that allows you to reduce storage costs while no significant impact to performance so you can store and search everything.

> **[Data tiers | Elasticsearch Guide \[7.15\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.15/data-tiers.html)**

---

<div class="post-metadata">

**Author:** ![parasavelli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/parasavelli/32/96601_2.png) [@parasavelli](https://discuss.elastic.co/u/parasavelli)\
**Post date:** [November 3, 2021, 8:16pm UTC](https://discuss.elastic.co/t/what-are-the-best-practices-for-reading-logs-data-from-cold-or-frozen-data-more-than-3-6-or-12-months-old/288167/3 "2021-11-03T20:16:29Z")

</div>

Thank you @stephenb.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2021, 8:16pm UTC](https://discuss.elastic.co/t/what-are-the-best-practices-for-reading-logs-data-from-cold-or-frozen-data-more-than-3-6-or-12-months-old/288167/4 "2021-12-01T20:16:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.