Dynatrace Grail Log Ingest Measurement

[GregOReilly]

I'm seeking a DQL query that provides detailed insights into log ingest. Currently, without Grail, we can observe log volume based on the number of log lines. However, Grail measures logs by size. Although the default Grail UI displays the previous log lines count, I'm interested in a DQL query that offers log ingest information based on size. Additionally, I'd like the query to break down the data by log.source and dt.process.name so that I can gain a comprehensive understanding of my sources in relation to their respective sizes.

In my opinion, I believe that since Grail now considers the size of logs, enhancing the UI to display both volume/lines and size would be a valuable improvement.

[ChadTurner]

@GregOReilly Your last paragraph sounds like a great RFE. I am still quite new to Grail but maybe our other community members that have more experience in Grail can lend you a hand with formulating the query 

[alter]

I tried to figure out any way to get log size distribution, but there are no good options. You can get the events count, but not the size - there is no direct correlation between the number of events and total size as the sources differ.

The only way to actually see the size is to check the small info button:

But using this method, to get a distribution of log sizes by log source, we will have to query the data for a large period for a particular log source, and write it down. Then query the next log source, and write it down, etc. This is nuts!

It won't show anomalies in sizes over some days, and if we need to split even further (by pod/container/etc/error level) - again run 1 query at a time and write it down. 

There isn't a single command or function that would actually return the size. It seems like it is intentionally hidden, as obviously the size is known (see above) + there is a parameter limiting the amount of data to fetch:

Anyone got any ideas how to gather the stats? It is important for license management and keeping the sizes in check