How do I write a search to monitor daily license usage by index and trigger an alert if it crosses 10GB?

[chris1]

Hi ,

Actually I want to monitor License for specific index and if it crosses e.g 10 GB limit, then it should trigger the alert. Can someone help me with the search?

Thanks..

[jensonthottian · Accepted solution]

index=_internal source=*license_usage.log type=Usage
| stats sum(b) AS bytes by st
| eval MB= round(bytes/1024/1024,1)
| st= MB>10000
| fields st MB

Trigger condition when results>0.

[chris1]

I am getting "Unknown search command 'st'" error when I execute that command..

[jensonthottian]

index=_internal source=*license_usage.log type=Usage
| stats sum(b) AS bytes by st
| eval MB= round(bytes/1024/1024,1)
| st=yourIndexName MB>10000
| fields st MB

Trigger condition when results>0.

st=yourindexname - add this . Due to formatting it got wiped off I guess

[chris1]

my index is test. below query is correct?

index=_internal source=*license_usage.log type=Usage
| stats sum(b) AS bytes by st
| eval MB= round(bytes/1024/1024,1)
| st=test MB>10000
| fields st MB

[jensonthottian]

index=_internal source=*license_usage.log type=Usage st=test
| stats sum(b) AS bytes by st
| eval MB= round(bytes/1024/1024,1)
| where MB>10000
| fields st MB

It should work now, I tested it.

[chris1]

st means sourcetype right? I need it for index

[jensonthottian]

for index use this :

index=_internal source=*license_usage.log type=Usage idx=test
| stats sum(b) AS bytes by idx
| eval MB= round(bytes/1024/1024,1)
| where MB>10000
| fields idx MB

[chris1]

Yeah. it worked. great. instead of st I have used idx. it looks good now. Thank you very much!!

[jensonthottian]

No problem, please accept and vote for the solution and comments.

Thanks.

[jensonthottian]

A little issue in the query ..

index=_internal source=*license_usage.log type=Usage st="yourIndexName"
| stats sum(b) AS bytes by st
| eval MB= round(bytes/1024/1024,1)
| where MB>10000
| fields st MB

It should work now, I tested it.

[chris1]

Hi,

Also I need it for specific index, not for all index or sourcetype.

[jensonthottian]

yes, st=yourspecificindexname