Processed-archive retention
When Log Lens imports a log file, it keeps a copy of the raw bytes in its processed/ archive. That archive is what lets you open the original event text behind any issue. Over time it grows, so Log Lens can prune it automatically using two independent rules.
The two rules
Both rules live under retention in your configuration:
| Key | Effect | Default |
|---|---|---|
processed_max_age_days | Delete archived logs older than N days | 0 |
processed_max_files | Keep only the N newest archived logs | 0 |
A value of 0 disables that rule. Set either, both, or neither. When both are on, a file is removed if it is too old or beyond the count limit - the newest files are kept and the oldest are dropped first.
'retention' => [
'processed_max_age_days' => 30, // drop archives older than 30 days
'processed_max_files' => 500, // keep at most 500 newest archives
],
Files are ranked by modification time, so age and count decisions both favor the most recent archives.
When it runs
Pruning runs automatically after every incoming import - you don't schedule anything. If both rules are 0, the step is skipped. You can also trigger a prune on demand and check the current archive size (file count and total bytes) without deleting anything; see Prune the processed archive.
What it affects
Pruning touches only the archived raw files. It never changes your indexed data:
- Issue groups, occurrence counts, first/last-seen dates - untouched.
- The only thing lost is raw-event retrieval for occurrences whose archive file was removed.
When you open such an occurrence, Log Lens handles the missing source gracefully rather than erroring. So retention trades away the ability to re-read original text in exchange for disk space, while your dashboard, counts, and history stay intact.
Edge cases
- Retention is a background convenience, not a deletion tool. To remove indexed logs, use Scoped log deletion instead.
- If a file can't be deleted (permissions, in use), it is left in place and counts toward the kept total.
- Only files matching the log-file pattern in the archive are considered; other files are ignored.