You can now use Rehydration in the Control Plane to query your logs in cold storage. We’ve noticed 1TB of uncompressed data to be made available in 20 minutes, which is significantly faster than most tools out there.
To create a rehydrated index:
You’ll need to have configured a Cold Storage already.
Currently, rehydration of only logs is supported.
The defined time range which needs to be rehydrated will be live for the same duration as the default logs retention, i.e. 14 days, after which it’ll expire and will need to rehydrated again if required.
You can choose to be notified once rehydration is complete.
To use a rehydrated index:
Once the rehydrated index is live, click on Query next to the index. It’ll redirect you to the relevant Explorer with the index selected and will be highlighted in the top left. Currently, the Explorer UIs do not support selecting an index directly.