# Log ingestion size

**URL:** <https://community.grafana.com/t/log-ingestion-size/74672>\
**Category:** Grafana Loki\
**Tags:** grafana-cloud, logs, loki\
**Created:** [October 23, 2022, 9:20am UTC](https://community.grafana.com/t/log-ingestion-size/74672 "2022-10-23T09:20:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![demeof](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/demeof/32/26915_2.png) [@demeof](https://community.grafana.com/u/demeof)\
**Post date:** [October 23, 2022, 9:20am UTC](https://community.grafana.com/t/log-ingestion-size/74672/1 "2022-10-23T09:20:07Z")

</div>

Hi all,

I’m relatively new to Loki and I’m experimenting with Grafana Cloud free tier. I just received a notification that I have exceeded my monthly log ingestion limit, which is quite weird since I have the grafana agent sending logs only from my local raspberry pi and a small NAS and some probes.

I’ve been trying to find out the cause of this huge log increase over the past week but I can’t seem to figure out the right query and the math doesn’t check out.

All logs should have a label `instance` that identifies who sent the log, so my query is this:

```auto
sum by(instance) (bytes_over_time({instance=~".+"} [$__range])) / 1024^3

```

The result that I get is a table with the aggregated results. Each line has a different instance name and the column `Value #A` should show the number of gigabytes sent over the specified range which in this case is 30days. However, as you can see from the picture below, the sum of all of them barely gets to 5gigabytes.

 ![Screenshot 2022-10-23 at 11.16.11](https://us1.discourse-cdn.com/grafana/original/3X/d/9/d9b613e09f90b0eca34bbe194435370a82be2a31.png)

Here is a screenshot from the grafana dashboard related to usage. As you can see it looks like it just wend exponential in the last week.

 ![Screenshot 2022-10-23 at 10.04.37](https://us1.discourse-cdn.com/grafana/original/3X/6/e/6e1a7b46f3c98876e9cde09fb068b139d183fd39.png)

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![demeof](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/demeof/32/26915_2.png) [@demeof](https://community.grafana.com/u/demeof)\
**Post date:** [October 23, 2022, 2:46pm UTC](https://community.grafana.com/t/log-ingestion-size/74672/2 "2022-10-23T14:46:51Z")

</div>

Update:

I tried the same query proposed in this [tweet](https://twitter.com/wardbekker/status/1362777417933324299?lang=en) and I confirm that it doesn’t look like I ingested more than 5 GigaBytes of logs.

 ![my-query](https://us1.discourse-cdn.com/grafana/original/3X/4/8/482ef2e3c09d3bb2d72523c9b666a836d467c289.png)

All my logs have the “instance” label, so I’m pretty sure I’m not missing other logs with this query.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/grafana/original/2X/e/ef5308cc58c9e5a13187b5012eb99f406928462f.png) [@system](https://community.grafana.com/u/system)\
**Post date:** [October 23, 2023, 2:47pm UTC](https://community.grafana.com/t/log-ingestion-size/74672/3 "2023-10-23T14:47:18Z")

</div>

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.