Configure Indexes for Log Retention in ObserveOps
Indexes control how long ObserveOps stores your logs and which logs go into which retention bucket. You create inclusion criteria to route specific logs into an index, set retention periods, and enable/ disable indexes to control which one captures each log first.
How It Works
Every log that passes through the Observability Pipeline is checked against the inclusion criteria of each active index, in order from top to bottom. The log falls into the first index whose criteria match. A log can fall into only one index, and it is stored there for that index's retention period.
The Configure Indexes Screen
Go to Settings > Observability Pipeline > Log Pipeline, then click Configure Indexes to expand the section.
The list shows all indexes with their INDEX name, FILTER, and RETENTION columns.
Pre-Configured Indexes
ObserveOps allows four index buckets, which are pre-configured in every new deployment as:
| Index | Retention |
|---|---|
| 30 Day Retention | 30 Days |
| 15 Day Retention | 15 Days |
| 7 Day Retention | 7 Days |
| 3 Day Retention (Default) | 3 Days |
The 3 Day Retention (Default) index is enabled by default and sits at the bottom of the list. It uses a select * filter that matches all logs. Every log that does not match a higher-priority index falls into this default index and is kept for 3 days.
Edit an Index
Click the edit icon next to any index to update its Name, Description, or Retention Days.
Retention changes apply to all logs already in the index, not just new ones. Lowering the retention period removes logs that exceed the new limit. This cannot be undone.
Inclusion Criteria
Each index can hold maximum two inclusion criteria. Each criterion has a Name and a Filter.
To add an inclusion criterion: Open the index and click + Add Inclusion Criteria. Enter the name and filter, then click Save.
To edit a criterion: Click the edit icon on the criterion row.
To delete a criterion: Click the delete icon on the criterion row.
Index Ordering and Priority
Logs check indexes in order, top to bottom. The log falls into the first index whose inclusion criteria match. Therefore, configure the indexes and inclusion criteria accordingly.
Turn an Index On or Off
Indexes cannot be deleted. Use the toggle to turn each index on or off. When an index is off, its criteria are skipped.
What Happens When No Index Matches
If a log does not match any active index, it falls into the default index at the bottom of the list. This is why the default index uses select *: it catches everything that no other index captures.
-->