send log to bucket s3

[toporagno]

hello all,

I would need the logs to be sent to my S3 bucket smartstorage after 1 month from my security index, but they should still be accessible for another 5 months.

[richgalloway]

Indexers will automatically copy buckets from local storage to SmartStore/S3 when they roll from hot to warm.  You can try to tune the hot bucket lifetime to 30 days, but I don't recommend it.  Let them roll normally and size your SmartStore cache so it's large enough to hold 30 days' of data.

Use the frozenTimePeriodInSecs setting in indexes.conf to specify the lifetime of the data.  Buckets will be removed from S3 when the newest event in the bucket is older than the specified time.