Data Backup

Copy your logs every hour to a bucket you own, to keep them for as long as you need and query them with your own tools.

Zharp keeps logs for your plan's retention. Data backup writes a copy of every line to Amazon S3, Cloudflare R2, Google Cloud Storage, Backblaze B2, Wasabi or any S3-compatible storage. You pay your provider for the storage; the lines don't count against your log allowance again.

Set it up

1. 1
   Create a bucket and a key

   The key only needs to write files under the folder. Zharp never reads, lists or deletes anything. On AWS:

   IAM policy

   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Action": "s3:PutObject",
       "Resource": "arn:aws:s3:::<bucket>/<folder>/zharp/logs/*"
     }]
   }

2. 2
   Connect it

   Open Settings → Data backup → Connect a bucket. Pick the provider, then enter the bucket, the region (AWS) or endpoint (others), an optional folder, and the key. Test connection writes a small file, zharp/logs/.zharp-test; saving runs the same test first.

3. 3
   Choose about history

   Also back up the logs Zharp already has copies what your plan still keeps, once, in the background. Without it, backups start from the hour you turn it on.

What lands in the bucket

Each hour is copied about 15 minutes after it ends. Files are in folders by date and hour, so Athena, BigQuery and ClickHouse read only the hours a query asks for:

s3://<bucket>/<folder>/zharp/logs/dt=2026-11-09/hour=14/arrived-20261109T14.json.gz
s3://<bucket>/<folder>/zharp/logs/dt=2026-11-05/hour=08/arrived-20261109T14.json.gz   ← a late line
s3://<bucket>/<folder>/zharp/logs/dt=2026-11-01/hour=07/history-20261101.json.gz       ← logs from before you turned it on

Query it with Athena

CREATE EXTERNAL TABLE zharp_logs (
  timestamp string, received_at string, severity string, body string,
  service string, host string, environment string, release string,
  app_id int, trace_id string, span_id string, session_id string,
  user_id string, attributes map<string,string>, resource map<string,string>
)
PARTITIONED BY (dt string, hour string)
ROW FORMAT SERDE 'org.openx.data.jsonserde.JsonSerDe'
LOCATION 's3://<bucket>/<folder>/zharp/logs/'
TBLPROPERTIES (
  'projection.enabled' = 'true',
  'projection.dt.type' = 'date', 'projection.dt.format' = 'yyyy-MM-dd', 'projection.dt.range' = '2026-01-01,NOW',
  'projection.hour.type' = 'integer', 'projection.hour.range' = '0,23', 'projection.hour.digits' = '2',
  'storage.location.template' = 's3://<bucket>/<folder>/zharp/logs/dt=${dt}/hour=${hour}/'
);

If it fails

• The page shows the error, and Zharp retries every few minutes, picking up where it stopped.
• After 6 hours of failures the workspace owner gets an email and a notification, then one a day.
• Hours older than your plan's retention can no longer be copied; if that happens they are listed as skipped.
• Switching it off (On → Paused) stops copying; on resume, missed hours are copied as long as Zharp still has them.