I am not familiar with the License Usage App, but I would make sure that it is displaying relevant data for all custom indexes, not just "main". I would also directly find out what the license manager says by looking in index=_internal source=*license_audit.log and looking at todaysBytesIndexed for each day. To further analyze where the usage may be coming from, you can run queries against the index=_internal source=*metrics.log , or look at the http://localhost:8000/en-US/app/search/indexing_volume view in 4.1+ which does the same. The size of the index on does not provide you with an accurate count about the amount of data indexed. The size on disk is the size of compressed data plus the size of index files. This is frequently half (or even less) than the actual index volume. ... View more