I'd like to include this in an email alert. I've got various emails to alert when going over but I'd like to show the number of warnings in that 60 day rolling window.
This query will give the number of warnings for each indexer.
index=_internal source=*license_usage.log type=SlaveWarnSummary