I don't know if there exists a module (off-topic anyway on this site), but you could try to implement your own cron hook. First disable the built-in clean up process by setting "Database log messages to keep" to "All" in the UI.
Then implement your own hook_cron(), similar to the core hook
/core/modules/dblog/dblog.module
/**
* Implements hook_cron().
*
* Controls the size of the log table, paring it to 'dblog_row_limit' messages.
*/
function dblog_cron() {
// Cleanup the watchdog table.
$row_limit = \Drupal::config('dblog.settings')->get('row_limit');
// For row limit n, get the wid of the nth row in descending wid order.
// Counting the most recent n rows avoids issues with wid number sequences,
// e.g. auto_increment value > 1 or rows deleted directly from the table.
if ($row_limit > 0) {
$connection = \Drupal::database();
$min_row = $connection->select('watchdog', 'w')
->fields('w', ['wid'])
->orderBy('wid', 'DESC')
->range($row_limit - 1, 1)
->execute()->fetchField();
// Delete all table entries older than the nth row, if nth row was found.
if ($min_row) {
$connection->delete('watchdog')
->condition('wid', $min_row, '<')
->execute();
}
}
}
only that your hook keeps the search entries or moves them to a different table.