Question

A financial services company aggregates application logs into a centralized logging service. Compliance requires that logs be retained and searchable for 90 days, but auditors may request access to logs up to 7 years old on rare occasions. The team notices their monthly logging costs have tripled because all logs remain in the high-performance searchable tier indefinitely. Which approach best balances compliance, retrieval needs, and cost?

Accepted Answer

Configure a retention policy that keeps logs in the searchable hot tier for 90 days, then automatically exports them to low-cost archival object storage retained for 7 years.

Answer

Reduce the log verbosity level so fewer logs are generated and all logs can remain in the hot tier within budget.

Answer

Delete all logs older than 90 days to eliminate the storage cost, since older logs are rarely accessed.

Answer

Keep all logs in the hot searchable tier but enable compression to reduce the storage footprint and cost.