anchor.diff:          pollInterval: 15m <4>
   ...
   ----
  -<1> For each log source, the retention policy indicates when to delete and
  -rollover logs for that source.
  -<2> When {product-title} deletes the rolled-over indices. This setting
  -is the `maxAge` you set in the `ClusterLogging` CR.
  -<3> The index age for {product-title} to consider when rolling over the indices.
  -This value is determined from the `maxAge` you set in the `ClusterLogging` CR.
  -<4> When {product-title} checks if the indices should be rolled over.
  -This setting is the default and cannot be changed.
  +<1> For each log source, the retention policy indicates when to delete and roll over logs for that source.
  +<2> When {product-title} deletes the rolled-over indices. This setting is the `maxAge` you set in the `ClusterLogging` CR.
  +<3> The index age for {product-title} to consider when rolling over the indices. This value is determined from the `maxAge` you set in the `ClusterLogging` CR.
  +<4> When {product-title} checks if the indices should be rolled over. This setting is the default and cannot be changed.
   +
   [NOTE]
   ====
  -Modifying the `Elasticsearch` CR is not supported. All changes to the retention
  -policies must be made in the `ClusterLogging` CR.
  +Modifying the `Elasticsearch` CR is not supported. All changes to the retention policies must be made in the `ClusterLogging` CR.
   ====
   +
  -The OpenShift Elasticsearch Operator deploys a cron job to roll over indices for each
  -mapping using the defined policy, scheduled using the `pollInterval`.
  +The OpenShift Elasticsearch Operator deploys a cron job to roll over indices for each mapping using the defined policy, scheduled using the `pollInterval`.
   +
   [source,terminal]
   ----
  
positive.code:       nodeCount: 3
  ...
  ----
  <1> Specify the time that Elasticsearch should retain each log source. Enter an
  integer and a time designation: weeks(w), hours(h/H), minutes(m) and seconds(s).
  For example, `1d` for one day. Logs older than the `maxAge` are deleted.
  By default, logs are retained for seven days.
  
  . You can verify the settings in the `Elasticsearch` custom resource (CR).
  +
  For example, the Red Hat OpenShift Logging Operator updated the following
  `Elasticsearch` CR to configure a retention policy that includes settings
  to roll over active indices for the infrastructure logs every eight hours and
  the rolled-ver indices are deleted seven days after rollover. {product-title} checks
  every 15 minutes to determine if the indices need to be rolled over.
  +
  [source,yaml]
  ----
  
negative.code: [id="cluster-logging-elasticsearch-retention_{context}"]
  = Configuring log retention time
  
  You can configure a _retention policy_ that specifies how long the default Elasticsearch log store keeps indices for each of the three log sources: infrastructure logs, application logs, and audit logs.
  
  To configure the retention policy, you set a `maxAge` parameter for each log source in the `ClusterLogging` custom resource (CR). The CR applies these values to the Elasticsearch rollover schedule, which determines when Elasticsearch deletes the rolled-over indices.
  
  Elasticsearch rolls over an index, moving the current index and creating a new index, when an index matches any of the following conditions:
  
  * The index is older than the `rollover.maxAge` value in the `Elasticsearch` CR.
  * The index size is greater than 40 GB × the number of primary shards.
  * The index doc count is greater than 40960 KB × the number of primary shards.
  
  Elasticsearch deletes the rolled-over indices based on the retention policy you configure. If you do not create a retention policy for any log sources, logs are deleted after seven days by default.
  
  .Prerequisites
  
  * OpenShift Logging and the OpenShift Elasticsearch Operator must be installed.
  
  .Procedure
  
  