Sure @DavideB :
Cold storage anything pushed on a stream will be (optionally) archived on PCA (daily file) for 1, 2, 5 or 10 years (DEFLATED or LZMA, you choose) with md5/sha256 fingerprints on LDP.
Indice as a service you choose the number of shard (25 gb each, up to ten) by indice. You manage content on it and who can read/write. If size exceed, indice is marked as read only until you clean it. Theses indices will be in the LDP clusters, so you can (optionally) correlate your logs with "static contents" available on your indices.
Do these features match your need?