Skip to main content

Prune the processed archive

When Log Lens finishes reading a log file, it moves the raw input into a private processed/ archive so you can still open the exact event text behind any issue. That archive grows over time. Use retention to cap it by age, by file count, or both - then prune whenever you like.

Pruning only affects raw-event retrieval. Deleting an archived file makes the original text unavailable for its occurrences; your indexed issues, occurrence counts, first/last-seen dates, and fingerprints are untouched. The API handles a missing raw file gracefully.

Configure the retention policy

Set two keys under retention in config.php. 0 disables a rule; both default to 0, so nothing is pruned until you opt in.

KeyEffectDefault
processed_max_age_daysDelete archived logs older than N days0 (off)
processed_max_filesKeep only the N newest archived logs0 (off)
'retention' => [
'processed_max_age_days' => 30, // drop archives older than 30 days
'processed_max_files' => 500, // keep the 500 newest archives
],

When both rules are active, files are sorted newest-first: anything older than the age cutoff is removed, and once the kept count reaches processed_max_files the remaining tail is dropped too.

Check the current archive size

GET /?api=processed-retention

Returns the active policy plus how much you are holding:

{
"policy": { "processed_max_age_days": 30, "processed_max_files": 500 },
"archived_files": 812,
"archived_bytes": 419430400
}

Prune on demand

POST /?api=processed-retention

The response reports what happened alongside the fresh status:

{
"status": { "...": "..." },
"pruned": {
"enabled": true,
"scanned": 812,
"deleted": 312,
"freed_bytes": 161061273,
"remaining": 500
}
}

enabled is false when both rules are 0; in that case nothing is deleted no matter how large the archive is.

You rarely need to trigger this by hand: Log Lens prunes automatically after every incoming import, so once the policy is set the archive stays within bounds on its own.