Log retention is configured when the pricing plan is selected. Lite and Standard plans have a 7-day retention period, while the Enterprise plan has longer retention periods. Log retention is based on the timestamp of the event; any event older than your retention period will be removed from our servers. More information on timestamps is available. To retain logs beyond the maximum retention period, you should archive your logs. See S3 Archiving.
In order to get the most value out of your Loggly account, we encourage you to send us every log event. Part of the reason we offer the free trial is so that you can figure out how much data you’ve got. Send everything, free for 30 days, and you’ll be able to figure out what volume limit is best for you by looking at your Overview page. This is also where you can look to see if you’re going over your daily volume limit.
You can change the daily volume limit at any time, and all billing is prorated. Check out the Account section to see how to add capacity to your account.
- Logs sent over syslog:
- Customer token and syslog eID are subtracted from total length of event.
- The rest of the message will count toward your data limits.
- Logs sent over HTTP(s):
- Customer token, standard HTTP preamble, and all headers are subtracted from the total length of the event.
- The POST body and the remainder of the URI count will count towards your data limits.
The Enterprise tier of service provides Peak Overage Protection (POP), which ensures that all of your data will be captured even if you exceed your subscription level. Customers may exceed their subscription by up to 100% (or 50GB, whichever is less) on any three days in a month (alternative rules can be set if determined with us in advance). If the subscription level is exceeded more than three days in any month, data beyond the subscription level will not be indexed or retained until the account is upgraded to a subscription level that would not have resulted in capping.
Standard and Lite plans have a maximum daily volume which cannot be exceeded. Any data received in excess of the subscription level will not be processed. Account activity is tracked per calendar day (UTC), so if you happen to send over your daily limit, indexing will terminate for the day, but will resume at midnight UTC.
When the APM Integrated Experience is enabled, Loggly shares a common navigation and enhanced feature set with the other integrated experiences' products. How you navigate the product and access its features may vary from these instructions. For more information, go to the APM Integrated Experience documentation.