Type to search.

Manage data retention for Synthetics

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

When you set up a synthetic monitor, data from the monitor is saved in Elasticsearch data streams, an append-only structure in Elasticsearch.

There are six data streams recorded by synthetic monitors: http, tcp, icmp, browser, browser.network, browser.screenshot. Elastic will retain data from each data stream for some time period, and the default time period varies by data stream. If you want to reduce the amount of storage required or store data for longer, you can customize how long to retain data for each data stream.

There are six data streams recorded by synthetic monitors:

Data stream Data includes Default retention period
http The URL that was checked, the status of the check, and any errors that occurred 1 year
tcp The URL that was checked, the status of the check, and any errors that occurred 1 year
icmp The URL that was checked, the status of the check, and any errors that occurred 1 year
browser The URL that was checked, the status of the check, and any errors that occurred 1 year
browser.screenshot Binary image data used to construct a screenshot and metadata with information related to de-duplicating this data 14 days
browser.network Detailed metadata around requests for resources required by the pages being checked 14 days

All types of checks record core metadata. Browser-based checks store two additional types of data: network and screenshot documents. These browser-specific indices are usually many times larger than the core metadata. The relative sizes of each vary depending on the sites being checked with network data usually being the larger of the two by a significant factor.

If Synthetics browser data streams are storing data longer than necessary, you can opt to retain data for a shorter period.

To find Synthetics data streams:

  1. In Kibana, navigate to Index Management.

  2. Filter the list of data streams for those containing the term synthetics.

    1. In the UI there will be three types of browser data streams: synthetics-browser-*, synthetics-browser.network-*, and synthetics-browser.screenshot-*.

  1. Navigate to Project settings → Management → Index Management → Data Streams.

  2. Filter the list of data streams for those containing the term synthetics.

    1. In the UI there will be three types of browser data streams: synthetics-browser-*, synthetics-browser.network-*, and synthetics-browser.screenshot-*.

Then, you can refer to Customize data retention policies for integrations to learn how to apply a custom ILM policy to the browser data streams.