--- title: Long-term log storage with live archives source: https://docs.newrelic.com/docs/logs/get-started/live-archives --- Live archives allows you to store logs for as long as you need. New Relic has a thirty-day retention for logs by default, but with live archives, you can extend that period for up to seven years. Like old tax documents, sometimes you don't need your data close at hand, but it's safe to keep the information available for reference if needed. Is live archives for you? Here are some use cases where you might benefit from this feature: - **Internal retention requirements**: Does your company have a policy that requires you to keep logs for a certain period? The extended storage periods of live archives may help you meet your requirements. - **Trends and long-term debugging**: Long-term log storage can help improve year-over-year performance. For example, if you manage a retail company, you can compare logs from one holiday season to the next to see how you can improve performance. ## How live archives works [#how-it-works] The live archives feature offers long-term log data storage that you intend to query sparingly for a lower storage cost. With live archives, you can have peace of mind knowing your logs are available for a longer period for potential audits or long-term debugging, but you will be charged separately for storage and querying your old data. ## Get started ### Enable live archives [#enable] First, you need to request live archives capabilities. 1. On the **Data retention** UI page, located in the [data management hub](https://one.newrelic.com/data-management-hub). 2. Scroll down to **Logging live archives**. 3. Hit **Request**. A member of our team will reach out to you. 1. Once you've enabled live archives, you need to edit your data retention. 1. On the **Data retention** UI page, located in the [data management hub](https://one.newrelic.com/data-management-hub) select **Edit data retention**. 2. Scroll down to **Logging live archives** and enter the total number of days you'd like your data stored. Keep in mind that this includes the standard retention days. 3. Click **Apply changes**. Keep in mind that you will need [Admin capabilities](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts/#roles) to edit data retention. ![A screenshot showing users how to edit their data retention.](https://docs.newrelic.com/images/logs_screenshot-crop_edit-data-retention-live-archives.webp "edit data retention") ### Create a partition using live archives [#partitions] A partition is a way to group logs based on specific criteria. Creating partitions can help you filter out the logs you don't need and keep the ones you do with live archives. 1. Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Logs**. 2. To the left of the logs query bar, click **Data partitions**, then click **Create data partition**. 3. Define a Partition name as an alphanumeric string that begins with Log\_. 4. Select the field **Use live archives on this partition**. ![A screenshot showing a user how to create a partition using live archives](https://docs.newrelic.com/images/logs_screenshot-crop_create-a-partition-using-live-archives.webp "create a live archives partition") Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Logs > Data partitions** to create a partition using live archives. 5. The **Total effective retention** days will be updated to reflect the regular retention _and_ the [live archives retention](https://docs.newrelic.com/docs/logs/get-started/live-archives-billing/#what-counts). You can also edit an existing partition clicking the icon on the **Data partitions** page. If you use an existing partition, the same parameters that you selected for the original partition will apply to your live archive data. ![A screenshot showing a user how to edit a partition using live archives](https://docs.newrelic.com/images/logs_screenshot-crop_edit-data-partition-using-live-archives.webp "Edit a live archives partition") For more information about how to use partitions, see our doc [Organize data with partitions](https://docs.newrelic.com/docs/logs/ui-data/data-partitions/). ## Query your logs > #### ⚠️ IMPORTANT > > Users can query logs in live archives if they have the Live archives query [permission](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-permissions/). Refer to [user management concepts](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts/) for more information about using groups, roles, and permissions to control access to certain features. There are a few ways to query live archives: Lucene, NRQL, or NRQL in the NerdGraph API. For all three methods, you'll need the **Live archives query** capability to query live archives. ### Query live archives with Lucene query syntax [#query] If you're familiar with Lucene query syntax, you can execute it in our **Logs** UI. 1. Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Logs**. 2. Using the search bar, run your desired query. Practicing your query first is best to ensure it works as expected. 3. Select the dates you'd like to query. 4. A screen will show you that you're about to query live archives. Querying live archives is more expensive, so only select **Query live archives** if you're ready. ![A screenshot showing a user how to query live archives in the logs UI](https://docs.newrelic.com/images/logs_live_archives_query_confirmation.webp "lucene live archives") Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Logs** to query data stored with live archives. ### Query live archives with NRQL [#nrql] If you want to query using the same language you use for errors inbox or alerts, we suggest querying in NRQL. 5. Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Logs**. 6. Click **NRQL** in the top right corner. 7. Enter the NRQL query you want to run. 8. Practice the query first to make sure it works as expected. 9. Toggle **Use live archives**. 10. A screen will show you that you're about to query live archives. Querying live archives is more expensive, so only select **Query live archives** if you're ready. ![A screenshot showing a user how to query live archives with NRQL](https://docs.newrelic.com/images/logs_screenshot-crop_query-live-archives-nrql.webp "nrql live archives") Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Logs**, then select **NRQL** to query data stored with live archives using the query builder. ### Query live archives using NerdGraph API [#api] You can also query your live archives data using NRQL in the NerdGraph API. You must include the `{eventNamespaces: "Logging:Archive"}` in the NRQL options to specify the live archives `eventNamespace`. Here is an example query: ```graphql query { actor { account(id: 1234567) { nrql( query: "SELECT count(*) FROM Log SINCE '2024-02-01 12:00:00' UNTIL '2024-02-01 13:00:00'" options: { eventNamespaces: "Logging:Archive" } async: true ) { results } } } } ``` ### See your data consumption [#data-consumption] Live archives is billed differently than the rest of your logs. You can read more about it in our [Live archives storage: Billing and rules documentation](https://docs.newrelic.com/docs/logs/get-started/live-archives-billing/). Live archives has three billing pillars. - **Data**: You will be charged for when you originally ingest the regular logs. - **Storage**: Live archives charges a fee for storing your data with live archives. - **Compute**: Queries of live archives data will be billed in Compute Capacity Units. See our [Usage plan documentation](https://docs.newrelic.com/docs/licenses/license-information/usage-plans/new-relic-usage-plan/#list-price) for more information about Compute Capacity Units. To see your data storage on the **Plan & Usage** page: 1. Go to **[one.newrelic.com](https://one.newrelic.com/)**, click the user menu, and then click **Administration** to open the **Plan & usage** page. 2. Scroll down to **Retention (GB-month)**. 3. Click **View more details** for more information about the storage breakdown. Once you query live archives, you can explore your compute consumption in the consumption management hub. 4. Go to **[one.newrelic.com](https://one.newrelic.com/)**, click the user menu, and then click **Administration**. 5. Select **Consumption management**. 6. Scroll down to **Product capabilities**. 7. Select **Logs**. 8. Facet by **Data category** to view compute consumption for live archives. ## Example [#examples] Let's say you need to check if a user logged into a machine from their computer to fulfill a ticket on September 1st. You can use live archives to help confirm that this took place by completing the following steps: 1. Check the time frame that the user logged into their machine. 2. Test your query in **Logs** to ensure it's working as expected. This is a dry run and won't return any data, but you're just validating the query. If it works, you can then run the more expensive query on your archived logs. Example query: ``` "logtype":"linux_audit" "type":"USER_LOGIN" "hostname":"apache_svr01" ``` 3. Change the time selector to search for the dates the user logged into their machine. 4. Select **Query live archives**. ## Data deletion [#delete] If at any point you want to reduce your data retention, please note: - You will need Admin privileges to edit data retention. - _You can't recover data if you reduce data retention later. Please choose and configure your retention periods carefully._ - Your data deletion is effective on the day you reduce your retention. - You can request to delete your data for any given set of days. We'll delete all live archives data for the selected dates. - Days start and end on UTC boundaries, so when making a request, ensure it aligns with UTC. This can mean adding or subtracting a day. > #### ⚠️ IMPORTANT > > For the avoidance of doubt, New Relic has no obligation to retain data in live archives after account downgrade or lapse in contract, or otherwise if you do not meet applicable commercial requirements. [Understand how live archives billing works](https://docs.newrelic.com/docs/logs/get-started/live-archives-billing) [Learn more about creating data partitions](https://docs.newrelic.com/docs/logs/ui-data/data-partitions/) [Query your logs](https://docs.newrelic.com/docs/logs/ui-data/query-syntax-logs/)