Log partitions ingest logs based on the routing filter that you configure for each partition in the Log Partitions page. You can query and analyze logs from specific partitions in the Explore Logs page.
- Indexed partitions
If you create an indexed partition, you are billed only for the volume of logs ingested into the partition. You can search and analyze logs in the partition with quick results and without incurring additional costs. Use indexed partitions to ingest logs that you plan to query regularly.
Indexed partitions retain logs for up to 30 days.
- Non-indexed partitions
If you create a non-indexed partition, you are billed for the volume of logs ingested into the partition, the storage duration, and also for searching the logs. Querying logs from these partitions renders slower results than indexed partitions. Use non-indexed partitions to ingest logs that you do not plan to query regularly.
Non-indexed partitions retain logs for up to seven years. If you intend to query the logs frequently, you can move all or specific logs to a common recall partition for 30 days. In this partition, you can search and analyze the logs with quicker results and at no extra cost.Note: Alerts and dashboard widgets are not operational in non-indexed partitions.
You can change the order in which logs are ingested into log partitions, based on their routing filters. Logs are ingested into non-indexed partitions first, followed by indexed partitions. The logs that do not match the routing filters in any of the indexed or non-indexed partitions go to the default indexed partition, which is read-only and stores logs for 30 days.