Hello @rodney_vdw,
I would recommend reading over this post to get a clear idea on rotation strategy.
You are still required to size your Opensearch nodes appropriately for the amount of data you want to store. Look at your daily ingest in GB across all indices, then think how many days you you want to store logs for. Take 10GB for 30 days as an example and a small allowance for variance within that 10GB a day, the simplest equation would be 10301.3=390GB. Double that if you wanted a replica set of each index.
In the above example data-tiering isn’t active, it’s really only worth considering using snapshots in larger clusters with heavier ingesting or where you need to store the logs in live storage for a long period of time.