How to check log volume indexed per day in a particular index

[iqbalintouch]

Is there anyway to check how much log is being generated with DEBUG log mode for a particular index?

Let say if index name is my_index and I need to check what is size of log generated for DEBUG mode log

index=my_index DEBUG
@woodcock plz help 🙂

[to4kawa]

| tstats count where index=my_index TERM("DEBUG") by _time span=1d

@iqbalintouch how about this?

[iqbalintouch]

@to4kawa thank you for the response. I am getting the result but not sure if that is showing log size..if yes, is there way to convert in GB size?

[to4kawa]

This query counts the events.
How much is  your one event size?

| eval GB=round(count * <your event size(byte)> / 1024 /1024 ,2)

try above.

[iqbalintouch]

Unfortunately, that I don't know how much data is being sent in a single event since we are seeing these events in REQUEST/RESPONSE which we send/receive from a third party. 😞

@to4kawa 

[to4kawa · Accepted solution]

index=my_index TERM("DEBUG") 
| eval len=length(_raw)
| timechart span=1d sum(len) as len_byte
| eval GB=round(len_byte/1024/1024/1024,2)

how about this? @iqbalintouch 

[iqbalintouch]

@to4kawa thank you, this is great help.
sorry for the late response, also could you please explain the query..how it is calculating 🙂

[to4kawa]

#1 search the text "DEBUG"
#2 calculate the event by length()(unit: byte)
#3 aggregate for bytes
#4 calculate by Giga Byte.