Hello to all,
We have a few indexes that are configured with different max MB's. I want to be able to create a dashboard that shows pie charts of each index that shows total size of the index vs how much actual data is in each index.
I have no problems hard-coding the total values, but how do I get how many MB are being used in each index?
And for another elementary question, how I chart the total value vs the used value?
Thanks for the help!
To get the index sizes you can use this search
| eventcount summarize=false report_size=true index=* | eval MB = size_bytes / 1024 / 1024
To get the max index size, perhaps you could make a CSV and use it as a lookup: Here in the docs
Finally how to chart? Perhaps take a look at the Visualization the docs But to help start by making a table lik e this:
... | table index MB total_MB
This doesnt seem to work? I tried the eventcount command... what it shows in MB as the size of my indexes is less than what it shows when i navigate to the index folder on the server and less than what it shows in Settings > indexes. Settings > Indexes and the actual folder sizes on disk match up.