Graylog 5.2 calculating Ingest Size

[stephen127000 (Mr Stephen Pefanis)]

Hi All

I’m running Graylog 5.2, I would like to understand the total data ingested so we can cost it out properly.

Is there a way to get an DataIn value, which would indicate the volume of data beeing ingested? I saw the metrics but i’m not sure which one I need for the counter.

I’ve been asked to price up moving to the “paid” version and also options for other solutions.

[Joel_Duffield]

Graylog is licensed based on how much data is outputted to OpenSearch, so that is why there is the “output” chart on system>overview, that is the amount that will count for a Graylog license.

[stephen127000 (Mr Stephen Pefanis)]

thanks. Is there any way to calculate an “Ingest” size? or would that be what people clasify as ingest?

[Joel_Duffield]

When we talk about it we normally talk about ingest as that output amount, the amount that hits the inputs of Graylog and has to be dealt with does effect how many Graylog nodes you need, but unless you are dropping 75% of all traffic or something it doesnt effect it in a meaningful way.