Are _internal per_host_thruput logs always created for hosts logging events?

[pj]

We have seen situations where hosts logging a small number of events do not seem to be getting any _internal host_thruput_logs. Is there a certain volume amount that must be hit before a reporting hosts gets an associated _internal log?

[ziegfried · Accepted solution]

Only the top 10 hosts are logged this way by default. You can override this in limits.conf:

[metrics]

maxseries = <integer>
* The number of series to include in the per_x_thruput reports in metrics.log.
* Defaults to 10.

[ziegfried]

You can check yourself how much series are logged per interval by executing a search like this: index=_internal source=*metrics.log group=per_host_thruput | timechart span=30s dc(series) as dc_hosts | stats avg(dc_hosts) max(dc_hosts) min(dc_hosts)

[gkanapathy]

I suspect ziegfried is correct. In any given 30-second interval, only the top 10 hosts are logged. If some hosts are never logged, it is probably because they are never in the top 10. You can have many hundreds logged if your top 10 are changing a lot.

[pj]

Pretty sure that it is not related to this. We have plenty of hosts (over 200+) coming into our indexers from this particular forwarder. All the hosts show up in the _internal index with per_host_thruput data apart from a handful which do not.