Log buckets and retention
powered by Grail Preview
Logs powered by Grail can be stored in different buckets. The first rule that you define determines your bucket. Within each bucket, you can also choose retention periods. If you don't want to store certain logs, you can exclude them.
Choose retention period
To choose your data retention period:
- In the Dynatrace menu, go to Settings > Log monitoring > Ingest pipeline > Bucket assignment.
- Select Add rule and name your rule.
- Select Bucket and choose the retention period (35 days, 1 year, 3 years).
If you need to exclude certain logs from storage, you need to choose the Don't store in a bucket option.
Note: Logs excluded from storage are still processed by log events and metrics. - Add Matcher (DQL). In case you selected Don't store in a bucket, the matcher query needs to specify the logs that you do not want to store.
- Select Save changes.
Example 1: Store logs for 3 years
If you need to have a 3-year retention period for the logs whose content contains the word 'error', you can name your rule as 'Error log 3-year retention', select the 3-year bucket, and add the below Matcher (DQL) :
matchesPhrase(content, "error")
Example 2: Exclude logs
If you need to exclude all logs having the drop
value in their log.source
attribute, you can name your rule as `Exclude drop logs', then select Don't store in a bucket, and add the below Matcher (DQL):
matchesValue(log.source, "drop")