Modify the details for a log partition such as the name, description, retention period, routing filter, and so on.

Note: You cannot modify the default indexed partition.

Prerequisites

Verify that you have a premium or a trial subscription for VMware Aria Operations for Logs (SaaS).
  • If you have a trial subscription, you must activate log partitions before using the subscription. To activate partitions, go to Log Management > Log Partitions and click Enable Partitions.
  • If you have a free subscription, you cannot use log partitions.
  • If you have a premium subscription, log partitions are available by default, and you do not have to activate the feature.
For information about subscriptions, see VMware Aria Operations for Logs (SaaS) Subscriptions and Billing.

Procedure

  1. Click the two arrows icon in the upper-left corner of the screen to expand the main menu.
  2. Navigate to Log Management > Log Partitions.
  3. Locate the partition that you want to modify in the Indexed Partitions or Non-Indexed Partitions section.
    Tip: You can also search for the partition by entering keywords in the search text box.
  4. Click the three dots icon against the partition name and click Edit Partition.
  5. Modify the relevant information.
    Option Description
    Name Modify the display name for the log partition.
    Description Modify the description for the log partition.
    Retention

    Modify the number of days for which you want to retain logs in the log partition.

    You can retain logs for up to 30 days in an indexed partition and up to seven years in a non-indexed partition.
    Routing Filter

    Modify the routing filters to ingest the logs corresponding to the filters into your partition. You can also use a favorite query.

    Optionally, click Show Logs to preview the filtered log results and Show Chart to view a graphical representation of the log results.
    Data Forwarding to Non-Indexed Partitions If you are modifying a non-indexed partition, do either of the following:

    • Select the Forward Data to Indexed Partitions check box to store the logs in both your partition and in indexed partitions. You can either forward all the logs in your partition or add filters to forward specific logs in your partitions.

      If some or all the forwarded logs match the routing filters defined in certain indexed partitions, these logs are stored in the relevant partitions, based on the ingestion order. The forwarded logs that are not stored in any indexed partition go to the default indexed partition.

    • Clear the Forward Data to Indexed Partitions check box if you do not want to forward the log data in your partition to indexed partitions.
    Note:
    • You cannot modify the partition type.
    • If you are modifying a non-indexed partition for which you have selected the data grouping option, you cannot modify the fields by which the log data is grouped.
  6. Click Update.