LogScale Measurement Repositories
We log your data volume in multiple repositories. You can use them to run audits to see how much data you ingest, which repositories it went to, and how much are you storing.
humio-organization-usage View
The humio-organization-usage view is available to Cloud customers, and contains data from two repositories, humio-measurements and humio-usage.
The humio-organization-usage view contains logs with information on how much data you are ingesting to LogScale, how much data you have stored, and in which repositories. It also tells you how much data you are scanning when searching through logs.
You can filter the logs by which repository they come from by using the repositoryName field in the humio-measurements repo or the repo field in the humio-usage repository.
If you have LogScale self-hosted license, you have access to these repositories directly, and because of that, do not have humio-organization-usage view.
The following query in your humio-organization-usage View is visualized on the Usage Page as your license consumption:
#measurement = "processed_events"
| repositoryName="*"
| sum(field = byteCount)
To see usage for a specific repository, you can replace the
"*" with a specific repository title.
Note that if your order form notes that we define data volume as "raw (uncompressed) data ingested by the product", we derive your usage of the license volume from the segmentWriteBytes metric instead. This is the amount of data in bytes written to the disk.
humio-usage Repository
The logs in this repository are the results of an hourly query to the humio-measurements repository. It differs from the humio-measurements repository in the following: it has unlimited retention, data is being logged once every hour, and it does not include data on ingestion source. Moreover, the usage measurements are provided as fields in the log.
In the table below, there are some of the more interesting fields a log line could have:
| Field | Example Value | Explanation |
|---|---|---|
| #processedEventsSize | 124534 | The size of an event ingested by the LogScale platform, in bytes |
| #sampleRate | hour | To which period the values in this log pertain to. 1 hour in most cases. |
| #sampleType | usageTag | If this log line refers to a repository, or a set of repositories that are grouped under the same usageTag. The value can be one of the following: organization, usageTag or repository. |
| repo | your_repo_name | The repository name measurements in this log line pertain to, if #sampleType is repository. |
| dataScanned | 123546 | The amount of data that was scanned in the last hour in #sampleType. |
| ingestBytes | 23123 | The amount of data that was ingested to this #sampleType in the last #sampleRate, measured in bytes. |
| segmentWriteBytes | 12313214 | The amount of data in bytes written to the disk in the last hour. |
| storageSize | 129071068836 | Total disk usage in the #sampleType. |
| queryStart | 2021-06-28T07:31:23.044Z | The time window beginning of querying the humio-measurements repository. |
| queryEnd | 2021-06-28T07:31:23.044Z | The time window end of querying the humio-measurements repository. |
| logId | 21 | The id that binds the logs of different #sampleType together. See the section on LogId below. |
LogId in LogScale Usage Repository
The logs with different #sampleTypes share one
value, which is the logId.
| #sampleType | processedEventsSize | logId |
|---|---|---|
| repository | 2909 | 2 |
| repository | 1290 | 2 |
| repository | 879 | 2 |
| organization | 5078 | 2 |
By tracing the logId, you can drill down into your usage, and find out what your usage was in a specific time period, down to an hour, by repository. Since there is unlimited retention on this repository, you will always be able to see your usage from the beginning of your usage of LogScale.