I need to try to determine how much size logstash is taking up in indexing the logs.
We have a 3 node elastic search cluster with logstash indexes on each one corresponding to the same days.
on ES node 1:
on ES node 2:
on ES node 3:
So my question is, is the right approach to total all of the sizes from the 3 nodes for each day? So I would add the size of logstash-2015.06.17 on ES node1 to the sizes of the same index day for ES node 2 and ES node 3?
Or is there another way I need to do that?