Sudden increase in license usage after the "Anaconda' upgrade

[ptur]

Our cloud instance was upgraded 3 days ago, since then the log volume increased by about 20% - we're logging same amount of data as for the past 3+ years - have anyone had to deal with similar issue? 

I looked at indexes - they all seem to increased logging proportionally, which leads me to believe it a change in the current version...that made it "less efficient" in this respect...

Thanks!

[PickleRick]

Check number of logs across days. Check event size across says...

[Stefanie]

Is there a chance that data is being duplicated? Run a search like index=_internal source=*license_usage.log for data up to 3 days ago.