Retention
Retention
How long events live, what expiry does, and how to keep data past it.
Retention is set per dataset, from 1 to 400 days. It is the multiplier on your bill and the single most effective cost lever you have.
cURL
curl -X PUT https://api.logstreem.com/v1/datasets/api-gateway-prod \
-H "Authorization: Bearer $LOGSTREEM_TOKEN" \
-H "Content-Type: application/json" \
-d '{ "retention_days": 90 }'What expiry does
- Blocks past the window are dropped whole, on a daily sweep. Expiry is not instantaneous at the second.
- Shortening retention deletes data immediately on the next sweep and cannot be undone.
- Lengthening it does not resurrect anything already dropped.
Keeping data longer
Mirror compressed blocks to your own S3-compatible bucket. Mirrored blocks stay queryable through the same API and the same LSQL — they are just read from your storage instead of ours, and you pay your own storage bill for them.
cURL
curl -X PUT https://api.logstreem.com/v1/datasets/api-gateway-prod/mirror \
-H "Authorization: Bearer $LOGSTREEM_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"bucket": "s3://acme-observability-archive",
"region": "us-east-1",
"role_arn": "arn:aws:iam::123456789012:role/LogstreemMirror",
"after_days": 90
}'Check retention before an audit, not during
Compliance windows are usually longer than debugging windows. If one dataset needs 400 days and the rest need 30, split them — see datasets.