app: unit: days count: 14 The recommended way to permanently increase the default retention period is to use a  helm  upgrade  command, passing the new value as a parameter. This ensures that any future chart  or IBM Cloud Private upgrades do not overwrite the value with the default value used during  chart installation. To update the retention period to 14 days using  helm upgrade  from the  command line, use  helm upgrade logging ibm-icplogging-2.2.0.tgz --reuse-values  --recreate-pods --set curator.app.count=14 --force --no-hooks --tls For testing purposes, the default retention period is easily customized by modifying the  logging-elk-elasticsearch-curator-config  ConfigMap. To modify the retention period from  1 day to 14 days edit the  logging-elk-elasticsearch-curator-config  ConfigMap and  modify the  unit_count  in the first action named  delete_indices . The result should look  similar to Example 5-4. After saving and closing the file, the new curator configuration will be automatically reloaded  and indices will be retained for 14 days. Also within this ConfigMap, cleanup actions are provided for the Vulnerability Advisor indices. The platform ELK is deployed with mutual TLS security enabled by default, using Search  Guard to provide PKI. It’s possible to disable  this during IBM Cloud Private installation by  adding the following to the  config.yaml 5.2.4 ELK security Chapter 5. Logging and monitoring  163 actions: 1: action: delete_indices description: "Delete user log indices that are older than 1 days. Cron  schedule: 30 23 * * *" options: timeout_override: continue_if_exception: True ignore_empty_list: True disable_action: False filters: - filtertype: pattern kind: prefix value: logstash- - filtertype: age source: name direction: older timestring: '%Y.%m.%d' unit: days unit_count: 14 Example 5-4 Curator modified configuration Configuring data retention after installation