Log retention

Retention is a per-stream policy: keep logs hot and instantly queryable for N days, roll them into cheap cold storage for months, then delete. Hosted platforms make the tradeoff impossible to ignore because they price it directly, but they do not all price it the same way. Ingestion, indexing, archive storage, and length of retention are separate billing dimensions, and which of them you are actually charged for depends on the product and the plan: some meter volume ingested, some meter indexed events, some bundle a fixed window and charge to extend it. Defaults are usually far shorter than people assume and the multiplier between a 7 day and a 90 day window can be large, so read your own provider's current pricing and defaults rather than trusting a remembered per GB per day rule of thumb.

Pick the window from how you actually work. Debugging an incident wants 7 to 30 days hot. Answering 'when did this start?' wants 90 days or more, but usually as metrics and aggregates rather than raw lines, which is cheaper by orders of magnitude. Compliance regimes (SOC 2, PCI, HIPAA) set floors on some log types and privacy law sets ceilings on others, so audit logs and app debug logs almost never deserve the same policy.

Gotchas: retention is the setting everyone discovers during an incident, at the exact moment the evidence expired. Check the default now, because it is usually shorter than you assume. Cold-tier logs are typically not searchable without a rehydration step that takes minutes to hours and costs money. And the fastest way to cut a log bill is not a shorter window, it is emitting less: sample the chatty debug lines and drop health-check and asset requests at the source.