Log Search Billing Queries

In Log Search, users can create queries and visualizations to better understand how Armor bills against log usage. Users will want to review usage for both Agent and non-Agent log types.

Query For Armor Agent Log Types

To query Armor Agent log types:

In AMP, go to the Log Search screen.
Click on Discover.
Use the Change Index Pattern dropdown to view all customer accounts under your Partner account.
1. Click the View drop down, and change the Index Pattern to (Account ID)_partner.
2. Below the Search bar, click the link for +Add Filter
  1. Field = tenant.id
  2. Operator = is
  3. Value = (Partner Customer Account ID)
Below the Search bar, click the link for +Add Filter
1. Filter #1
  1. Field = tags
  2. Operator = is one of
  3. Values = armor agent, oslogs
    1. Type *armor_agent* and hit enter
    2. Type *oslogs* and hit enter
  4. Hit Save
2. Filter #2
  1. Field = tags
  2. Operator = is one of
  3. Values = windows, linux
    1. Type *windows* and hit enter
    2. Type *linux* and hit enter
  4. Hit Save
3. Hit the Refresh button

Visualization For Armor Log Types

To create a visualization for Armor Agent log types:

In AMP, go to Log Search screen.
Click on Visualize
In the New Visualization pop up, select the Data Table visualization option.
Choose a source.
Below the Search bar, click the link for +Add Filter
1. Filter #1
  1. Field = tags
  2. Operator = is one of
  3. Values = armor agent, oslogs
    1. Type *armor_agent* and hit enter
    2. Type *oslogs* and hit enter
  4. Hit Save
2. Filter #2
  1. Field = tags
  2. Operator = is one of
  3. Values = windows, linux
    1. Type *windows* and hit enter
    2. Type *linux* and hit enter
  4. Hit Save
3. Hit the Refresh button
In the Data tab, expand the Metric configuration
1. In the Aggregation dropdown, select Sum
2. In the Field dropdown, enter message_size
Under Buckets, click Add
1. Select Split rows
2. In the Aggregation dropdown, select Terms
3. In the Field dropdown, select external_id
Add another Bucket by clicking Add
1. Select Split rows
  1. In the Sub aggregation, select Terms
  2. In the Field dropdown, select winevent.log.source
Hit Update

Query For Non Armor Agent Log Types

In AMP, go to the Log Search screen.
Click on Discover.
Use the Change Index Pattern dropdown to view all customer accounts under your Partner account.
1. Click the View drop down, and change the Index Pattern to (Account ID)_partner.
2. Below the Search bar, click the link for +Add Filter
  1. Field = tenant.id
  2. Operator = is
  3. Value = (Partner Customer Account ID)
3. Below the Search bar, click the link for +Add Filter
  1. Filter #1
    1. Field = tags
    2. Operator = is not one of
    3. Values = armor_agent, windows, linux, oslogs
      1. Type *armor_agent* and hit enter
      2. Type *windows* and hit enter
      3. Type *linux* and hit enter
      4. Type *oslogs* and hit enter
    4. Hit Save
  2. Filter #2
    1. Field = data.type
    2. Operator = is not one of
    3. Values = trend
      1. Type *trend* and hit enter
    4. Filter #3
      1. Field = log.file.path
      2. Operator = is not one of
      3. Values = /opt/armor/filebeat
        Type */opt/armor/filebeat * and hit enter
      4. Hit Save
    5. Hit the Refresh button

Visualization For Non Armor Agent Log Types

In AMP, go to the Log Search screen.
Click on Visualize.
In the New Visualization pop up, select the Data Table visualization option.
Choose a source.
Below the Search bar, click the link for +Add Filter
1. Filter #1
  1. Field = tags
  2. Operator = is not one of
  3. Values = armor_agent, windows, linux, oslogs
    1. Type *armor_agent* and hit enter
    2. Type *windows* and hit enter
    3. Type *linux* and hit enter
    4. Type *oslogs* and hit enter
  4. Hit Save
2. Filter #2
  1. Field = data.type
  2. Operator = is not one of
  3. Values = trend
    1. Type *trend* and hit enter
  4. Filter #3
    1. Field = log.file.path
    2. Operator = is not one of
    3. Values = /opt/armor/filebeat
      1. Type */opt/armor/filebeat * and hit enter
    4. Hit Save
  5. Hit the Refresh button
3. In the Data tab, expand the Metric configuration
  1. In the Aggregation dropdown, select Sum
  2. In the Field dropdown, enter message_size
4. Under Buckets, click Add
  1. Select Split rows
    1. In the Aggregation dropdown, select Terms
    2. In the Field dropdown, select external_id
  2. Add another Bucket by clicking Add
    1. Select Split rows
      1. In the Sub aggregation dropdown, select Terms
      2. In the Field dropdown, select log.source
Hit Update