topic Re: /rootfs/var/log/journal/ utilizing more license. can we stop that from indexing? in Getting Data In

/rootfs/var/log/journal/ utilizing more license. can we stop that from indexing?

SS1 — Fri, 02 Oct 2020 22:06:31 GMT

Team,

Below search query is using maximum license in our environment. can we stop that from indexing?

index=_internal source="*license_usage.lo*" type=Usage s="/rootfs/var/log/journal/"

thambisetty — Sat, 03 Oct 2020 04:25:58 GMT

Yes, you can. Identify hosts which are sending logs from that source and modify monitor stanza in inputs.conf and deploy to those hosts.

SS1 — Sat, 03 Oct 2020 04:31:47 GMT

Does disabling journal logs affect any other perfomance stats?