Section 5 of 8 Storage & performance
Retention & rotation
Retention is a product decision, not an ops afterthought. Define how long you need hot search versus cold compliance storage.
- Set TieredStorage.RetentionDays to match incident response windows (often 7–30 days for hot tier).
- Use LogFileNameFormat + RetentionDays on flat file sinks only when TieredStorage is not enabled.
- Archive Parquet partitions by yyyy/MM/dd so cold storage can be deleted folder-by-folder.
- Monitor logs/tiered/ and archive directories — disk alerts should fire before the app cannot write.
Example retention posture
| Environment | Hot tier | Cold archive |
|---|---|---|
| Local development | 3–7 days SQLite | Optional — delete archives weekly |
| Staging | 7–14 days SQLite | 14–30 days Parquet |
| Production | 7 days SQLite (tune to SLO) | 30–90 days Parquet or off-host backup |