I’m a victim of the new free Enterprise license which is now limited to 2GB/day. Until now, I was using the free 5GB/day license.
After import of the 2GB license, it’s being marked as violated immediately. Seems, that traffic which has been generated before the new license became valid and was covered by the previous 5GB license counts into the violations count which is totally weird. Is this an intended behavior or some bug? In case it’s intended, downgrading a license is virtually impossible, isn’t it?
You are correct, the free licensing was reduced form 5GB to 2GB per day. You can find your data per day under System/Overview.
If you want to continue using Enterprise options without purchasing a license you will have to reduce your output (to Elasticsearch/OpenSearch) to 2GB per day or less. If you are not using any of the Enterprise options, you can just remove the license and the warnings will go away. The base package without licensing is unlimited (well… limited by your own resources) in storage.
The license checks for five or more violations in the past 30 days. If you are downgrading a license, and you were collecting more than 2GB/day for five or more of the previous 30 days, it will count those as violations.
For paid customers, we just use a temp license until the higher ingestion rates are more than 30 days in the past. For the free license, you can either wait for your 2GB+ traffic to age out, or build a new cluster that does not have any historical collection.
As @tmacgbay pointed out, if you don’t use the enterprise features anyway, you can simply disregard the warnings. Collection continues uninterrupted and all OS features will continue to work normally. It is only the enterprise features that are disabled by a license violation.
