Delete indexed logs by date or source
Scoped deletion removes indexed occurrences for a single day or a single source file, then repairs the affected issues. Your raw log files and ingestion checkpoints are always left untouched.
Choose exactly one scope
Every deletion targets one scope. You cannot combine them, and you cannot omit both:
| Scope | What it matches | Format |
|---|---|---|
date | Every occurrence indexed for that day | YYYY-MM-DD |
source_id | Every occurrence from one source file | Numeric source ID |
An invalid date, a missing source, or supplying both (or neither) is rejected before anything is deleted.
Preview first
Always preview before you delete. The preview counts what the scope would remove without changing anything:
occurrences- indexed events matchedissue_groups- distinct issues touchedsources- source files touched
When you scope by source_id, the preview also echoes that source's path, log type, channel, size, and import time so you can confirm you have the right file. The preview also confirms raw_files_preserved and checkpoints_preserved.
Run the deletion
Deletion requires an exact confirmation string. Type the following literally:
DELETE LOGS
Anything else is refused. Once confirmed, Log Lens deletes the matched occurrences in a single transaction and then reconciles each affected issue:
- Issues that still have occurrences get their count, first seen, and last seen recomputed.
- Issues left with zero occurrences are removed only if they originated from ingestion.
The result reports how many occurrences and how many now-empty issue groups were deleted.
What is preserved
- Raw log files stay on disk. Deletion only clears the index, so you can reindex the same files later.
- Ingestion checkpoints stay in place, so incremental ingestion is not knocked out of step.
- Manual issues are never deleted. Only ingested issues are removed when they become empty, so anything you created by hand survives even if all its occurrences are cleared.