Skip to main content

Maintenance

Log Lens keeps two things: the index (SQLite: issues, occurrences, workflow, tags) and the archive (processed/ files holding raw event bodies). Maintenance tools operate on these independently. All are under Settings to Maintenance in the dashboard.

Scoped deletion​

Delete indexed occurrences for exactly one calendar day or one source, without touching archived files or connector checkpoints.

GET  /?api=log-deletion-preview&date=2026-07-21     # or &source_id=18
POST /?api=delete-logs                              # body: {"date":"2026-07-21","confirmation":"DELETE LOGS"}

Preview reports the affected occurrences, issue groups, and sources. Deletion removes matching occurrences, drops ingested groups that become empty, and recalculates count/first-seen/last-seen for survivors - transactionally. Manual issues, raw files, source metadata, and connector checkpoints are preserved.

Processed-archive retention​

Prune the processed/ archive by age and/or file count. Configured in config.php under retention:

'retention' => [
    'processed_max_age_days' => 30,   // delete archived logs older than 30 days
    'processed_max_files'    => 500,  // keep only the 500 newest
],                                    // 0 disables a rule
  • Runs automatically after each incoming import, and on demand via POST /?api=processed-retention (or the Maintenance tab's "Prune archive now"; GET reports the policy and current archive size).
  • Deleting an archived file only makes raw-event retrieval unavailable for its occurrences - indexed issues, counts, and dates are untouched (the API returns a graceful "archived source unavailable" for those raw fetches).

Reindex​

POST /?api=reindex reparses already-recorded sources in place - use after a severity-allowlist change or a parser-version bump. See Ingestion & Formats.

Rebuilding from scratch​

There is no "wipe everything" endpoint (removed by design). To rebuild an index: delete the indexed logs (scoped deletion above), then move or copy the desired archived files from processed/ back into logs/ and process them again.

Moving the workspace​

If you relocate the application's directory, stored absolute paths self-heal on the next request: SourcePathRepairService detects the moved workspace and re-points source_files/source_streams to the new processed//sources/ locations by matching file size. No manual DB surgery needed.