See Log retention in the Enterprise Search documentation for coverage of log retention management via ILM (Index Lifecycle Management).
App Search exposes several event logging settings through its Log settings API and a corresponding section of the Settings dashboard.
Use these controls to enable and disable logging of App Search API logs and analytics. These controls affect only App Search logs, but they do apply to all App Search engines.
Disabling either type of logging disables writing to these logs and does not affect existing log indexes. Existing data is retained and discarded according to your log retention policies, which apply equally to App Search and Workplace Search.
Enable/disable logging using the Log Settings APIedit
Refer to the Log settings API reference.
Enable/disable logging using the Settings dashboardedit
Navigate to /as#/settings/account (App Search > Settings):
Locate the controls for log settings:
Apply your changes and follow the prompts within the application.
Intro to Kibana
ELK for Logs & Metrics