Optimize Ingestion
To get the most out of your LogScale SaaS license, you can
remove data that you're confident you will not need, so it doesn't count
towards your license usage. This example filters the data using the
Removing Fields functionality in
Parser settings.
Important
This can be used to filter information from ingested structured data. The remove fields feature cannot be used to modify the @rawstring, or fields created when parsing the @rawstring. For more information, see Removing Fields.
 |
Figure 19. Usage Page
The remove fields feature with the name kubernetes.image from the incoming events. The usage calculation will then disregard these fields in the calculation.
Important
If you use the dropEvent() function during
parsing to optimize usage, the amount of data saved in
LogScale will be reduced.
However, the original data before being dropped will be included in the calculation for your license, and therefore dropping events will not affect your license usage according to the ingestAfterFieldRemoval metric.
Unless your order form specifies that your volume is calculated as
"raw (uncompressed) data ingested by the product"
(segment_save metric), we recommend that you switch to
either dropping events at source or using the
Removing Fields functionality.