How to load older logs or archives in EventLog Analyzer
Objective
EventLog Analyzer stores the logs collected as live data in Elasticsearch and simultaneously as archives for long term usage. This document guide users on accessing older log data by loading archive files in EventLog Analyzer for analysis and reporting.
Prerequisite
- Admin access to the EventLog Analyzer web console.
- Ensure sufficient disk space is available to load the required archive files. Loading archives temporarily expands data in Elasticsearch and may require additional storage.
Steps to follow
- In EventLog Analyzer, go to Settings → Admin Settings → Data Storage → Archive.
- This page displays a list of all available archive files.
- Under Select Devices, choose the device for which you want to load older logs.
- Use the Click to choose date range option at the top-right corner to select the period for which you need older logs.
- Once the device and date range are selected, the archive list will be filtered accordingly.
- You can choose to load all archive files or load only a specific log format. For example, if you want to load only MSSQL logs for the selected Widnows device, simply select the respective checkbox and click Load Archive.
- It is recommended to load a smaller set of data at a time. Loading very large archives may slow down the system. Before proceeding, review the displayed file size and approximate loading time.
- The status of the archive file will be updated as Loaded once the loading process is completed.
Tips
- Loading large archive files may take additional time depending on disk performance and available system resources.
- Set the archive retention period based on your internal compliance or storage policy.
- Configure the loaded retention period to control how long loaded archive data remains searchable in Elasticsearch.
- Only the required log types should be loaded to improve performance and reduce system overhead.
- Configure separate archive retention policy based on the requirement.