Log retention

Retention is a per-stream policy: keep logs hot and instantly queryable for N days, roll them into cheap cold storage for months, then delete. Hosted platforms make the tradeoff impossible to ignore because they price it directly. Vercel, Heroku, and Cloud Run keep hours to days by default, while Datadog and Sentry bill per GB per retention day, so the gap between 7 and 90 days can be a 10x line item.

Pick the window from how you actually work. Debugging an incident wants 7 to 30 days hot. Answering 'when did this start?' wants 90 days or more, but usually as metrics and aggregates rather than raw lines, which is cheaper by orders of magnitude. Compliance regimes (SOC 2, PCI, HIPAA) set floors on some log types and privacy law sets ceilings on others, so audit logs and app debug logs almost never deserve the same policy.

Gotchas: retention is the setting everyone discovers during an incident, at the exact moment the evidence expired. Check the default now, because it is usually shorter than you assume. Cold-tier logs are typically not searchable without a rehydration step that takes minutes to hours and costs money. And the fastest way to cut a log bill is not a shorter window, it is emitting less: sample the chatty debug lines and drop health-check and asset requests at the source.