Our cloud instance was upgraded 3 days ago, since then the log volume increased by about 20% - we're logging same amount of data as for the past 3+ years - have anyone had to deal with similar issue?
I looked at indexes - they all seem to increased logging proportionally, which leads me to believe it a change in the current version...that made it "less efficient" in this respect...
Thanks!
Check number of logs across days. Check event size across says...
Is there a chance that data is being duplicated? Run a search like index=_internal source=*license_usage.log for data up to 3 days ago.