I would like that the usage of enterprise edition is referring to the actually database storage or the summation of all input data before processing ?
Hi
As far as I know it use the System/overview Outgoing traffic data.
https://community.graylog.org/t/graylog-system-overview/5177
the data that is written to the database - so after processing but before it is written to elasticsearch.