Retention Policies

Retention policies delete events that match a specified signal, once they reach a certain age. A typical retention scheme for Seq might be:

• Delete Debug and Verbose events after 48 hrs
• Delete events from non-production environments after 7 days
• Delete all remaining events at 30 days

Each of these rules is represented by a retention policy.

Your retention policies will depend on the rate of incoming events, available machine resources, and organizational needs.

👍

Tip

To get rid of a particularly noisy event flooding your logs, consider applying a filter directly upon arrival using API keys.

Setting up a Retention Policy

In this example we'll create the policy implementing the rule:

Delete Debug and Verbose events after 48 hrs

The first step in creating a retention policy is to create a signal specifying the events to delete.

To select debug and verbose events, enter the filter:

@Level == "Debug" || @Level == "Verbose"

Then press the move to signal » button at the right of the filter bar, call the signal "Retained 48 hrs" and save it.

Your events screen should look something like:

Next, click Settings in the top menu bar, and choose Retention in the left menu.

Click Add Policy to create the new policy. Give the policy a name, and select the newly-created view in the Delete drop-down:

Click Save Changes to save the policy.

Retention Processing

Retention policy processing happens in the background, so you won't notice an immediate change.

🚧

Allowing for compaction time

Though events are deleted close to the time specified by a retention policy, it can take longer for Seq to reclaim free space that they occupied in the data file. This process, called Compaction, runs in the background on storage files once they reach 7 days of age. Compaction needs disk space to run, so it's important to over-provision the storage space available to the Seq server.

Excluding Events from Processing

To save an event from being deleted by retention processing, you can Bookmark or Permalink the event. Both of these options are available under the Pin menu you'll see when the event is expanded.