Team,
Below search query is using maximum license in our environment. can we stop that from indexing?
index=_internal source="*license_usage.lo*" type=Usage s="/rootfs/var/log/journal/"
Does disabling journal logs affect any other perfomance stats?
Yes, you can. Identify hosts which are sending logs from that source and modify monitor stanza in inputs.conf and deploy to those hosts.
