Logstreem
Retention

Retention

How long events live, what expiry does, and how to keep data past it.

Retention is set per dataset, from 1 to 400 days. It is the multiplier on your bill and the single most effective cost lever you have.

cURL
curl -X PUT https://api.logstreem.com/v1/datasets/api-gateway-prod \
  -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "retention_days": 90 }'

What expiry does

  • Blocks past the window are dropped whole, on a daily sweep. Expiry is not instantaneous at the second.
  • Shortening retention deletes data immediately on the next sweep and cannot be undone.
  • Lengthening it does not resurrect anything already dropped.

Keeping data longer

Mirror compressed blocks to your own S3-compatible bucket. Mirrored blocks stay queryable through the same API and the same LSQL — they are just read from your storage instead of ours, and you pay your own storage bill for them.

cURL
curl -X PUT https://api.logstreem.com/v1/datasets/api-gateway-prod/mirror \
  -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "bucket": "s3://acme-observability-archive",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::123456789012:role/LogstreemMirror",
    "after_days": 90
  }'

Check retention before an audit, not during

Compliance windows are usually longer than debugging windows. If one dataset needs 400 days and the rest need 30, split them — see datasets.