Assuming your data contains a field named "application", it would simply be ((index="digconn-timeser-prod") (kubernetes.container_name="*conn-server*")) | stats sum(eval(len(_raw))) as logsize by application If you have to derive application from kubernetes.container_name, do something like the following: ((index="digconn-timeser-prod") (kubernetes.container_name="*conn-server*")) | rex field=kubernetes.container_name "(?<application>conn-server-\w+)" | stats sum(eval(len(_raw))) as logsize by application ... View more