Storage rate for a specefic machine

Hello everyobody,

I have a production cluster where I have some windows machines connected to my ELK Cluster, and for some monitoring reasons, I would like to know how many data collected from each machine for eample for the last 24 hours

Could you please to tell me if there is a way to do that from an SQL request in canvas, or using the Dev Tool in kibana or any other way !

Thanks for your help

In terms of MB/GB per host stored in Elasticsearch?

Yes @warkolm that's what I would like to get as a result

Then take a look at Mapper Size Plugin | Elasticsearch Plugins and Integrations [7.12] | Elastic

1 Like

Thanks for your answer @warkolm ,

I just had access to my cluster today and I installed it, and restarted all the nodes.
If I understand well, to enable the _size field I should run the command in the DEV Tool of kibana :

PUT my-index-000001
{
  "mappings": {
    "_size": {
      "enabled": true
    }
  }
}

Is there a quick way to enable it in all my indexes (even the futur ones) ?

You cannot apply it to existing indices.
For future ones, make sure you add that to the relevant index template.

So, for example if my indice now it's packetbeat-7.12.0-2021.05.06-000012, I should apply it to the indice packetbeat-7.12.0-****.**.**-000013 , and then automatically it will be enabled for all the future indices ?

If you are using the default (aka bundled) Packetbeat template, you will need to tell Packetbeat to use a custom one (based on that template) with your additions.

Configure Elasticsearch index template loading | Packetbeat Reference [7.12] | Elastic should provide some assistance on that aspect.