Work out how many days of logs a given storage budget actually buys, and whether it clears your compliance retention floor.
Compression and index overhead pull in opposite directions: 8× compression on a payload that carries 25% index overhead nets an effective 0.156× of raw bytes per copy, which two replicas then double. Dividing available capacity by that daily figure gives the honest retention window. PCI DSS wants a year with 90 days immediately available, and most regulators want more — discovering your 'twelve-month' SIEM only holds seven months of data during an investigation is a very expensive surprise.
SIEM Log Retention
Stored GB/day = raw GB/day × (1 + index overhead) ÷ compression ratio × replicas; retention days = usable TB × 1,000 ÷ stored GB/day.
Policy shortfall
Storage for policy = stored GB/day × required days ÷ 1,000; shortfall = that figure minus usable TB.
Stored GB/day = raw GB/day × (1 + index overhead) ÷ compression ratio × replicas; retention days = usable TB × 1,000 ÷ stored GB/day. Compression and index overhead pull in opposite directions: 8× compression on a payload that carries 25% index overhead nets an effective 0.156× of raw bytes per copy, which two replicas then double. Dividing available capacity by that daily figure gives the honest retention window.
PCI DSS wants a year with 90 days immediately available, and most regulators want more — discovering your 'twelve-month' SIEM only holds seven months of data during an investigation is a very expensive surprise.
This calculator takes 6 inputs: Raw ingest per day, Usable storage available, Compression ratio, Search index overhead, Replica copies (including primary), Required retention (policy or regulation). The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Yes for compliance, usually not for detection. Regulators care that the data exists and is retrievable; correlation rules and hunts only see what is in hot or warm tiers, so track searchable retention and retained retention as two separate numbers.
For index-replicated platforms, yes — a replication factor of 2 stores every byte twice. Object-store-backed architectures instead rely on the store's own erasure coding, which typically costs 1.2–1.5× rather than 2×.