Is it possible to find the storage (logs) used by application/services in a particular index for particular time range?

[kcliff]

Is it possible to find the storage (logs) used by application/services in a particular index for particular time range? Or something similar

For ex. 

Query:

((index="digconn-timeser-prod") (kubernetes.container_name="*conn-server*")) |

((index="digconn-timeser-qa") (kubernetes.container_name="*conn-server*")) |

This would help identify logging  issues from apps/services side over a period of time

Result:

conn-server-latency 1105 GB last 5 days

conn-server-lag 1505 GB last 5 days

[yuanliu · Accepted solution]

Assuming your data contains a field named "application", it would simply be

((index="digconn-timeser-prod") (kubernetes.container_name="*conn-server*"))
| stats sum(eval(len(_raw))) as logsize by application

If you have to derive application from kubernetes.container_name, do something like the following:

((index="digconn-timeser-prod") (kubernetes.container_name="*conn-server*"))
| rex field=kubernetes.container_name "(?<application>conn-server-\w+)"
| stats sum(eval(len(_raw))) as logsize by application