Log buckets and retention

Logs powered by Grail can be stored in different buckets. The first rule that you define determines your bucket. Within each bucket, you can also choose retention periods. If you don't want to store certain logs, you can exclude them.

Choose retention period

To choose your data retention period:

In the Dynatrace menu, go to Settings > Log monitoring > Ingest pipeline > Bucket assignment.
Select Add rule and name your rule.
Select Bucket and choose the retention period (35 days, 1 year, 3 years).
If you need to exclude certain logs from storage, you need to choose the Don't store in a bucket option.
Note: Logs excluded from storage are still processed by log events and metrics.
Add Matcher (DQL). In case you selected Don't store in a bucket, the matcher query needs to specify the logs that you do not want to store.
Select Save changes.

Example 1: Store logs for 3 years

If you need to have a 3-year retention period for the logs whose content contains the word 'error', you can name your rule as 'Error log 3-year retention', select the 3-year bucket, and add the below Matcher (DQL) :

dql
matchesPhrase(content, "error")

Example 2: Exclude logs

If you need to exclude all logs having the drop value in their log.source attribute, you can name your rule as `Exclude drop logs', then select Don't store in a bucket, and add the below Matcher (DQL):

dql
matchesValue(log.source, "drop")