Data temperature classifies logs by how recently and how frequently they are accessed, guiding retention, query speed, and storage cost. section 2.3.3
For centralized logs, the practical categories are:
- Hot data is the active troubleshooting or development working set. Keep it readily accessible and fast to query, typically for days to weeks. section 2.3.3
- Warm data may be needed later but does not require immediate access. Retention can extend from months to years. section 2.3.3
- Cold data is rarely used, often retained for regulatory reasons, and belongs in cheap, durable object storage despite access delays of minutes or hours. section 2.3.3
Table 2.1 Overview of the costs of logs (view table figure)
Use the cost overview to compare instrumentation, agent, and destination considerations when assigning retention by data temperature. section 2.3.3
