You should pick a daily log volume that is equal to the maximum amount you expect to send in a day. If your normal log volumes are 1GB/day and you want to be able to handle bursts of 2GB/day, you should pick a 2GB/day volume.

Loggly will stop indexing data on your account if your daily volume is exceeded. Once your volumes drop below your daily limit, Loggly will resume indexing your data. In the event that you exceed your daily limit and your S3 bucket is setup to receive logs from us we will forward 200% of your daily limit to the S3 bucket as a courtesy.

Loggly stores your log data in a highly scalable searchable index housed on our servers. You should only store data in your index as far back as you need to search and retrieve log event data. Pick an index retention time that is greater than the typical amount of time in which you want to be able to search your logs.

If you need to archive logs longer than how long Loggly stores them in your index, you can configure your account to store a copy of all your logs in your own Amazon S3 bucket.

Please note that your S3 bucket's archive retention is not enforced by Loggly. You'll need to manually prune your archives by deleting files from S3, or set up a script to prune logs after a maximum retention period is reached.

Secure logging allows you to send data to Loggly in a secure, encrypted manner. Loggly supports sending secure data via HTTPS and Syslog over TLS.

Secure logging is available on all (including free) tiers.