Last 12 hours indexing size elasticsearch

[RamyaGowda (Ramya)]

Hi,
How do i get the total size of data received at my elasticsearch cluster for last 12 hours?

_stats API give total size of the cluster, but i need to filter out for only last 12 hours data received by elasticsearch
what is the query,or any specific API?

Help needed.

Regards,
Ramya

[dadoonet (David Pilato)]

If you are looking for the size in bytes, it's not really doable unless you added previously the mapper size plugin.
If you are using time based indices you can may be try to guess what was the size for the last 2 days using index stats API.
Another basic solution would be to compute the average size of a typical document, count the number of documents during the period you want and multiply by this average size.

[RamyaGowda (Ramya)]

@dadoonet
How to do this

If you are using time based indices you can may be try to guess what was the size for the last 2 days using index stats API.

[dadoonet (David Pilato)]

https://www.elastic.co/guide/en/elasticsearch/reference/7.1/indices-stats.html

[vasek (Václav Šulc)]

Hi @RamyaGowda Ramya
or you can determine size of daily indices if you have. And try to guess size of last 12 hour.

Switch for bytes:

bytes=b

ES Query

GET /_cat/indices/itles-sec*?v&bytes=b&h=index,store.size&s=store.size:asc

output:

index                store.size
itles-sec-2019.06.23 33776464751
....

[RamyaGowda (Ramya)]

@vasek Hi Vasek,

how could we guess how much data we recived for last 12 hours? it is a huge data that we are receiving.
Is there any filters can i apply on timestamp

[vasek (Václav Šulc)]

I was thinking in a simple way.

33776464751 per day = per 24 hours
33776464751 / 2 = 16888232375.5

But I point out that it is not accurate but it is very fast.

Of course you can use this approach If amount of received data is the same between 0-12 and 12-24.

[RamyaGowda (Ramya)]

@vasek
Thank you