/rootfs/var/log/journal/ utilizing more license. can we stop that from indexing?

[SS1]

Team,

Below search query is using maximum license in our environment. can we stop that from indexing?

index=_internal source="*license_usage.lo*" type=Usage s="/rootfs/var/log/journal/"

[SS1]

Does disabling journal logs affect any other perfomance stats?

[thambisetty]

Yes, you can. Identify hosts which are sending logs from that source and modify monitor stanza in inputs.conf and deploy to those hosts.