DDUS consumption for AWS custom logs

[HectorNP]

Hi, I have a saas instance and I am monitoring hosts hosted in aws and create a custom log to see all logs in a single path, but I realized that it was a lot of information and I consumed enough DDUS licensing, then disable in settings the global log option to enable only locally ie select each host and in settings enable the log, the problem is that now no longer shows me nothing the graph on the dashboard.

Is it possible to do it that way? or at the time of disabling globally even if I enable locally for each host does not work?

Regards

Before 

After

[ChadTurner]

Hey @HectorNP many times this happens it's due to filtering criteria on the tile. Can you verify that the tile which is formulated by the data explorer, isn't filtered on a host that is no longer include din your log detection rule?

[HectorNP]

Hi chad, thanks for replying, in data explorer I don't have any special filtering, I don't know if this is what you mean.

This image is what the metrics showed with the global log monitoring option enabled and with the individual log monitoring option disabled on each host.

and this happens if I disable the global option and enable the option individually on each host

Regards.

[ChadTurner]

@HectorNP it looks like you created a metric based off the log file is that correct? You stated that you disabled the segmetn that is allowing the logs from the Tenant Settings (Globally) but then you enabled it at the host level. Can you confirm that the host in question actually has the log file listed? 

I'm thinking a few things are at play. #1 a custom metric based off the log file was created as shown in your Data Explorer Screen cap. #2 The host/process isnt overriding the Environment level setting - OR - the log detection rule on the host/process is set up incorrectly.

[HectorNP]

Hello Chad thank you for your answer, in total there are 7 hosts which in each is enabled and configured in a single route which is the one shown in the screenshot I shared above, with respect to point number 2 when configured the custom log obtained the data correctly we want from the logs of the 7 hosts so I guess it was configured correctly, but this consumed almost all the DDUS license, so I asked if it is possible to enable only for each host and limit the consumption of license, when disabling the collection of data in the general configuration and enabling only the local is when I lost the information but if I leave the ‘global’ configuration and enable some local say 5 of 7 host still shows me all 7.

I hope I have explained myself well.

Regards