Does anyone know how I can query the license usage of a particular index, breakdown by a field?
Basically I have an index called testindex and there is a field in each event called logtype. I would like to know, on a given date, how much indexed data there is in this index, broken down by logtype. I would expect the output to be something like:
Any help will be greatly appreciated.
I fear the license usage logs aren't going to be helpful here, so you may need to go brute force:
index=particular | eval length = length(_raw) | timechart span=1d sum(length) by log_type
If you're going to run this more than once it'll be a good idea to summary index the daily data.
One quick question. The numbers returned from the query you suggested, are they in bit or byte or Mb? I want to have it set to GB, but when I changed sum(length) to sum(length/1024), it didn't work.
Technically they are in characters. Convert before the
timechart, so something like this:
... | eval length = length(_raw) / 1048576 | ...
to get the length in megacharacters.