General Purpose
The Index Management screen is used to manage the retention periods, statuses, and system resource usage of event and incident indexes within Logsign. This section allows you to determine which indexes remain active (Open), which ones are set to passive (Closed), and how long they are retained in the system.
Total Event Retention Period (Days)
This field defines how many days event logs will be retained in the system. Once the specified duration expires, the related indexes will be automatically deleted from the system.
The recommended value is 7 days. Keeping data longer may increase disk usage and CPU consumption.
Incident Retention Period (Days)
This field determines the number of days incident indexes (case data) are retained in the system. When the duration expires, these indexes will also be automatically deleted.
Event Warm Data Period (Days)
This field specifies how long an index will remain active (in the “warm state”) before it is automatically closed.
Once this period ends, the indexes will be automatically switched to “Closed” status.
If “0” is entered, automatic closing is disabled, and indexes must be managed manually.
During the daily maintenance process that runs at midnight, any indexes older than the defined number of days will be automatically closed.
Index List Section
This section lists all indexes currently available in the system. Each card represents one index file.
The displayed information includes the index name (for example: log_20251104), size, document count, and status.
The status of an index can be either “Open” or “Closed.”
Index Statuses
Open: The index is active. Searches, reports, and dashboards can be executed using this index. These indexes are referred to as “warm data.”
Closed: The index has been set to a passive state. It cannot be used for search or reporting operations. However, it can be reopened (“Open”) when needed. This helps reduce system resource consumption, especially RAM and CPU usage.
Recommendation:
Keeping the number of active (Open) indexes low helps improve overall system performance. It is recommended to retain live data for a maximum of one month, ideally one week. Older indexes can be kept in the “Closed” state and temporarily reopened when historical data access is required.