Monitor Usage

Security Requirements and Controls

Keeping an eye on how much data is flowing into your LogScale instance is useful to see whether you are within your license limits and to make sure that your ingestion pipeline is set up correctly and your internal users have on-boarded.

See License Installation for information on licenses and see Measurement Repositories for information on how you can dig into those numbers yourself.

Usage Page

On the Usage page, you can track and get an overview of your organization's usage, which includes ingest, storage, scanned data, and, if applicable, user seats.

The Usage page is available to organization owners only, and it can be found under Organization Settings → Usage.

Screenshot of the LogScale Usage Page in Organization Settings showing an overview dashboard with usage metrics including ingest volume, stored data, scanned data, and user seats. The interface includes graphical charts tracking usage over time and comparative metrics against license limits.

Figure 14. Usage Page


Current Usage

The current usage gives you an indication of your usage at the current moment and whether you are going above or below your order form values.

If you're exceeding your contract, the panel will indicate this with a warning.

The calculations displayed on this page do not apply to Falcon Long Term Repository, for information on your Falcon Long Term Repository license usage, please refer to the Usage Reports page in the Falcon Documentation.

Screenshot of the 'Current usage relative to license' panel showing four key LogScale metrics with their values and utilization rates: average daily ingest volume, total stored data size, average daily scanned data volume, and user count. Each metric is displayed with a progress bar indicating the percentage of license limit consumed, with visual indicators that highlight when usage approaches or exceeds contracted limits. This dashboard provides organization owners with an at-a-glance view of their compliance with license terms.

Figure 15. Current Usage


The following statistics are displayed:

  • Average ingest per day

    The amount of data in bytes before it was parsed in LogScale. For information on how this is calculated, see Measure Data Ingest.

  • Stored data

    The amount of data that you have stored in LogScale, in bytes.

  • Average scanned data per day

    Scanned data is the amount of data that was searched through when running queries. Every time a query runs, LogScale measures the amount of data it needs to look into to answer the query.

  • Users

    Number of registered users.

Ingest Over Time

In the ingest chart, you can get an overview of ingestion within a selected time period.

Average ingest per day is calculated as a 30-day moving average. This means, for example, that the value shown for the 15th of July is the average daily ingest in the period 15th of June to 15th of July. This is to allow for spikes in ingest.

The ingest chart also shows the license limit, and an indication for which periods the rolling average has passed the limit.

Line chart visualization showing daily data ingest volume over time with noticeable spike patterns. The graph displays both daily ingest amounts (represented as vertical bars with pronounced spikes) and the 30-day moving average (shown as a smoother line). A horizontal threshold line indicates the license limit, with colored highlights marking periods where the moving average exceeds this limit. This visualization helps administrators identify abnormal ingest patterns and monitor compliance with license agreements by distinguishing between temporary spikes and sustained high usage.

Figure 16. Ingest Over Time With Spikes Example


You can select a single date, which will update the data shown in the repository table.

Stored Data Over Time

In the Stored data over time chart, you can get an overview of the storage usage within a selected time period.

The storage chart will also show the license limit and indicate for which periods the storage has passed the limit.

Time-series chart displaying LogScale storage usage over time with a horizontal line indicating the license limit threshold. The visualization includes highlighted regions where storage has exceeded contracted limits and features interactive date selection capabilities that synchronize with the repository table view. This chart helps administrators monitor storage trends, identify periods of excessive data retention, and analyze how storage utilization has changed over time in relation to license constraints.

Figure 17. Stored data Over Time


As was the case for the ingest chart, you can select a single date, which will update the data shown in the repository table.

Repository Table

For both ingest and stored data, you can get an overview of the usage data based on the repositories that the data is in.

The data shown in the table correlates with the selected year, month and day from the chart.

In the table, you are able to search for specific repositories and sort based on name and value to get a better idea of which repositories have the most or least usage.

From the table, you can navigate to each repository or run a usage query in humio-organization-usage, which will show logs for that particular repository (#repo=NAME_OF_REPO). You must have permission to search in the humio-organization-usage repository for this to work as intended.

Screenshot of the Repository Table on the LogScale Usage Page showing a sortable data grid that displays repository-specific usage metrics. The table includes columns for repository names and corresponding usage values (such as data ingest or storage amounts), with search functionality at the top to filter repositories. Each row represents a different repository with its associated usage statistics, and includes action buttons for navigation to the repository or running usage queries.

Figure 18. Repository Table