app: 

unit: days 

count: 14 

## Configuring data retention after installation 

The recommended way to permanently increase the default retention period is to use a helm upgrade  command, passing the new value as a parameter. This ensures that any future chart or IBM Cloud Private upgrades do not overwrite the value with the default value used during chart installation. To update the retention period to 14 days using helm upgrade  from the command line, use helm upgrade logging ibm-icplogging-2.2.0.tgz --reuse-values --recreate-pods --set curator.app.count=14 --force --no-hooks --tls 

For testing purposes, the default retention period is easily customized by modifying the logging-elk-elasticsearch-curator-config  ConfigMap. To modify the retention period from 1 day to 14 days edit the logging-elk-elasticsearch-curator-config  ConfigMap and modify the unit_count  in the first action named delete_indices . The result should look similar to Example 5-4. 

actions: 1: action: delete_indices description: "Delete user log indices that are older than 1 days. Cron schedule: 30 23 * * *" options: timeout_override: continue_if_exception: True ignore_empty_list: True disable_action: False filters: - filtertype: pattern kind: prefix value: logstash- - filtertype: age source: name direction: older timestring: '%Y.%m.%d' unit: days unit_count: 14 

After saving and closing the file, the new curator configuration will be automatically reloaded and indices will be retained for 14 days. 

Also within this ConfigMap, cleanup actions are provided for the Vulnerability Advisor indices. 

## 5.2.4 ELK security 

The platform ELK is deployed with mutual TLS security enabled by default, using Search Guard to provide PKI. It’s possible to disable this during IBM Cloud Private installation by adding the following to the config.yaml 

