How long do you keep security logs before deleting them?

Start with any regulatory, insurance and contract requirements, including which logs they cover. Then involve security, incident response and legal in setting the policy. Those requirements may give you a minimum, not necessarily the period you want for investigations.

As a planning point, 90 days is one possible minimum where nothing longer is required, while a year gives more room to look back when new indicators of compromise turn up. Neither number fits every environment.

Does everything need to stay in the expensive, searchable tier? You could keep recent logs readily available and archive older ones. Six months live with older data in an archive is one option, though the split depends on how quickly you need to investigate.

Check that the archived logs can actually be retrieved in a useful timeframe. A long retention period isn't much help during an incident if nobody knows how to get the data back.

I'd separate security logs from routine operational logs rather than give everything the same deadline. One view is to keep security logs for at least a year, possibly several years for serious investigations or legal matters, while keeping other logs for a shorter period.

That will cost more, and not every security event deserves the same treatment. Volume, sensitivity and how useful each source is for an investigation should factor into the decision.

Storage still costs money, and keeping everything forever has its own risks, especially if the logs contain sensitive data. Set an explicit retention and deletion policy rather than letting an old storage limit make the decision for you.

If an investigation shows the chosen period was too short, document that and review the policy. Also make sure legal holds are considered when deletion would otherwise be due.

Three months may cover much of the day to day troubleshooting, but older logs can matter in sensitive environments or investigations that take longer to uncover. The useful window depends a lot on what you're logging, not just how much space you have.