Trying to evaluate our license model, planning for future.
We have the 100G/day license and a promo 100G/day license for a total of 200G/day.
Looking at our license report, we're using around 70G/day.
Checking the index usage page, we're showing around 120G/day usage.
I'm not sure the difference between the 2 and which is more accurate for our planning needs.
If we're indexing 130/G per day, why does our license report showing us using nowhere near this amount?
I would trust the license report for this. The metrics.log includes other things like _internal indexes which are not charged. It also shows the metrics.log reports from universal forwarders. So be sure to limit your query to just host = <indexers>*
host = <indexers>*
Hope this helps