diff --git a/docs/en/observability/index.asciidoc b/docs/en/observability/index.asciidoc index 9a4f12094c..960df87014 100644 --- a/docs/en/observability/index.asciidoc +++ b/docs/en/observability/index.asciidoc @@ -124,6 +124,8 @@ include::inspect-uptime-duration-anomalies.asciidoc[leveloffset=+3] include::configure-uptime-settings.asciidoc[leveloffset=+2] +include::synthetics-manage-retention.asciidoc[leveloffset=+2] + include::troubleshoot-uptime-mapping-issues.asciidoc[leveloffset=+2] // User experience diff --git a/docs/en/observability/synthetics-manage-retention.asciidoc b/docs/en/observability/synthetics-manage-retention.asciidoc new file mode 100644 index 0000000000..200c137906 --- /dev/null +++ b/docs/en/observability/synthetics-manage-retention.asciidoc @@ -0,0 +1,50 @@ +[[synthetics-manage-retention]] += Manage data retention + +When you set up a synthetic monitor, data from the monitor is saved in +https://www.elastic.co/guide/en/elasticsearch/reference/current/data-streams.html[{es} data streams], +an append-only structure in {es}. + +There are six data streams recorded by synthetic monitors: `http`, `tcp`, `icmp`, `browser`, `browser.network`, `browser.screenshot`. +Elastic will retain data from each data stream for some time period, +and the default time period varies by data stream. +If you want to reduce the amount of storage required or store data for longer, +you can customize how long to retain data for each data stream. + +[discrete] +[[synthetics-manage-retention-data-streams]] +== Synthetics data streams + +There are six data streams recorded by synthetic monitors: + +[options="header"] +|=== +| Data stream | Data includes | Default retention period | +| `http` | The URL that was checked, the status of the check, and any errors that occurred | 1 year | +| `tcp` | The URL that was checked, the status of the check, and any errors that occurred | 1 year | +| `icmp` | The URL that was checked, the status of the check, and any errors that occurred | 1 year | +| `browser` | The URL that was checked, the status of the check, and any errors that occurred | 1 year | +| `browser.screenshot` | Binary image data used to construct a screenshot and metadata with information related to de-duplicating this data | 14 days | +| `browser.network` | Detailed metadata around requests for resources required by the pages being checked | 14 days | +|=== + +All types of checks record core metadata. +Browser-based checks store two additional types of data: network and screenshot documents. +These browser-specific indices are usually many times larger than the core metadata. +The relative sizes of each vary depending on the sites being +checked with network data usually being the larger of the two by a significant factor. + +[discrete] +[[synthetics-manage-retention-customize]] +== Customize data stream lifecycles + +If Synthetics browser data streams are storing data longer than necessary, +you can opt to retain data for a shorter period. + +To find Synthetics data streams: + +. Navigate to https://www.elastic.co/guide/en/elasticsearch/reference/current/index-mgmt.html[{kib} index management]. +. Filter the list of data streams for those containing the term `synthetics`. +.. In the UI there will be three types of browser data streams: `synthetics-browser-*`, `synthetics-browser.network-*`, and `synthetics-browser.screenshot-*`. + +Then, you can refer to https://www.elastic.co/guide/en/fleet/current/data-streams.html#data-streams-ilm-tutorial[Tutorial: Customize data retention for integrations] to learn how to apply a custom {ilm-init} policy to the browser data streams.