Query to find index size per source server?

Elastic Stack Elasticsearch
1

I have a filebeat index that duplicated size from one day to another to 40GB.

filebeat-2016.11.11 y_7BZT0kRma7qWDdqBhYXQ 5 1 100973607 0 39.4gb 39.4gb

How can I find for that index the document number/size per source server using beat.hostname or my fields.server property?

2

I think you need to add the mapper size plugin for that.

See https://www.elastic.co/guide/en/elasticsearch/plugins/current/mapper-size.html

3

Do i need to reindex all docs after enabling that plugin?

Is there any other solution like If i just want to find and compare the number of documents ( not size ) indexed by source server what would be the query?

4

Yes. You need to reindex after this.

But if you need to just count and group by server, just run a terms agg on the server field.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.