# Limit Logs Consumed by Graylog

**URL:** <https://community.graylog.org/t/limit-logs-consumed-by-graylog/15415>\
**Category:** Graylog Central (peer support)\
**Created:** [May 12, 2020, 7:30pm UTC](https://community.graylog.org/t/limit-logs-consumed-by-graylog/15415 "2020-05-12T19:30:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DrVirus](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@DrVirus](https://community.graylog.org/u/DrVirus)\
**Post date:** [May 12, 2020, 7:30pm UTC](https://community.graylog.org/t/limit-logs-consumed-by-graylog/15415/1 "2020-05-12T19:30:33Z")

</div>

The free version of Graylog lets you capture up to 5GB of log per day. I only have one file server logging to Graylog but it appears to be consuming just over 5GB per day which is causing Graylog license to violate every week.

Is there a preferred method to only capture the logs I want in Graylog so I can whittle down my data consumption and be under the 5GB/day for logs?

My windows file server has the following advanced audit configuration parameters set:  
Object Access

- Audit Detailed File Share - Success
- Audit File Share - Success
- Audit File System - Success
- Audit Handle Manipulation - Success

I had created streams to only show me specific logs of interest but it seems there’s a lot more logs being captured than I want.

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [May 13, 2020, 5:29am UTC](https://community.graylog.org/t/limit-logs-consumed-by-graylog/15415/2 "2020-05-13T05:29:29Z")

</div>

You can use pipelines to drop the messages,what you don’t want to see, or decrease the log types what you send in.  
(or just shutdown your sender server 😃 )

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [May 13, 2020, 8:15am UTC](https://community.graylog.org/t/limit-logs-consumed-by-graylog/15415/3 "2020-05-13T08:15:56Z")

</div>

he @DrVirus

> The free version of Graylog lets you capture up to 5GB of log per day.

I like to clarify here:

Graylog is unlimited on a daily use level. The free Graylog Enterprise License - means the Enterprise features of Graylog - is limited to 5GB per day.

If you have more than 5GB of ingested logs, remove the Enterprise plugins and restart Graylog to have unlimited Graylog or contact Graylog Sales ( [http://graylog.org/contact-sales](http://graylog.org/contact-sales) ) to get a license that fits to your needs when you have the need of the Enterprise features.

The other option is what @macko003 suggest. Manipulate the messages and reduce the amount you ingest by only store what you really need.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 27, 2020, 8:16am UTC](https://community.graylog.org/t/limit-logs-consumed-by-graylog/15415/4 "2020-05-27T08:16:00Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.