Graylog 5 GB/Day Limit for Enterprise Free

Graylog Central (peer support)
1

Hello,

Does the limit of 5 GB/Day apply for raw logs or is this after they have been processed and compressed?

Thanks

2

The count is what is written to Elasticsearch, excluding the meta Information that are added by Graylog.

If you ingest a full webserver log, but only keep the request IP and URL only those two are counted.

Hope that this makes it clear.
Jan

3

The Graylog Enterprise License page makes it quite clear:

1.1. “Daily Volume Limit” means indexing by Customer of no more than 5 gigabytes of data per day using Software under this Agreement.

It states "indexing". So everything that you index in Graylog is counted. Everything that you drop before indexing (writing to Elasticsearch) is not counted.

Greetings,
Phil

Edit: Damn, @jan beat me to it :smiley:

4

I believe Elasticseach compresses the data before it is indexed. If for example 30 GB of logs were sent to Graylog but this was compressed down to 3 GB before it was written would this be over the 5 GB per day limit?

Thanks
Tyrell

5

When you already have a Graylog running - go over to System > Overview and see the count that is written to Elasticsearch.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.