Track Event Size Within a Repository

Calculate the event size and report the relative size statistics for each event using eventSize() function

Query

flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1["Expression"] 2[/Filter/] result{{Result Set}} repo --> 1 1 --> 2 2 --> result

logscale

eventSize(as=eventSize)
|timeChart(function=[max(eventSize),percentile(field=eventSize,percentiles=[50,75,90,99])])

Introduction

The eventSize() function is used to search for events depending on the internal disk storage usages. The function augments the event data with the event size information.

This query shows how statistical information about events can first be determined, and then converted into a graph that shows the relative sizes.

Example incoming data might look like this:

@timestamp	message	user	ip_address
2025-10-31T10:00:00.000Z	Short log message	alice	192.168.1.100
2025-10-31T10:01:00.000Z	Very long detailed error message with stack trace	bob	192.168.1.101
2025-10-31T10:02:00.000Z	Medium length message with details	charlie	192.168.1.102
2025-10-31T10:03:00.000Z	Another very long message with metrics	david	192.168.1.103
2025-10-31T10:04:00.000Z	Brief status	eve	192.168.1.104
2025-10-31T10:05:00.000Z	Standard length log entry	frank	192.168.1.105
2025-10-31T10:06:00.000Z	Extensive system report with details	grace	192.168.1.106
2025-10-31T10:07:00.000Z	Quick update	henry	192.168.1.107
2025-10-31T10:08:00.000Z	Detailed performance metrics and analysis	ivan	192.168.1.108
2025-10-31T10:09:00.000Z	System notification	julia	192.168.1.109

Step-by-Step

Starting with the source repository events.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1["Expression"] 2[/Filter/] result{{Result Set}} repo --> 1 1 --> 2 2 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
eventSize(as=eventSize)
```
Extracts the information about the size of each individual event using the eventSize() function.
flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 1["Expression"] 2[/Filter/] result{{Result Set}} repo --> 1 1 --> 2 2 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;
logscale
```
|timeChart(function=[max(eventSize),percentile(field=eventSize,percentiles=[50,75,90,99])])
```
Calculates the percentile() for the eventSize field and determines which filesize is above 50%,75%, and 90,99% of the overall event set, then finds the maximum size for the specified field over a set of events, and displays the returned results in a timechart.
Event Result set.

Summary and Results

The query is used to show how statistical information about events can first be determined, and then converted into a graph that shows the relative sizes.

Sample output from the incoming example data:

_bucket	_max	_50	_75	_90	_99
1698743400000	12500.0000000000000	3200.4022591419678	5800.0773414212163	8900.077513854012	11200.634566556551
1698743460000	11800.0000000000000	3100.6808775630843	5600.4994371767473	8700.077513854012	11000.634566556551
1698743520000	12200.0000000000000	3300.7503431765824	5900.4994371767473	9100.077513854012	11500.586660467782

Note that the output shows the maximum event size (_max) and different percentiles (_50, _75, _90, _99) for the events in each time bucket. The _bucket field contains epoch timestamps in milliseconds representing the start of each time interval.

Examples Library