I'm conducting a logs analysis to see what is contributing the most to log volume over the last 2 days. Follow the instructions and generate a report for me.
1. Determine the top 10 services for logs by volume over the past 2 days.
- Use logs aggregation query faceting on 'service'.
- Use the timeframe for the last 2 full days, e.g. day 1 00:00:00 UTC to day 2 23:59:59 UTC.
2. For each of the top 10 services, determine the top 10 'message' by log volume over the past 2 days.
- Use logs aggregation query filtering on 'service' and faceting on 'message'.
- Use the timeframe for the last 2 full days, e.g. day 1 00:00:00 UTC to day 2 23:59:59 UTC.
- Make one call per service.
- Some log source types may not allow you to query based on 'message' facet. Do not include these in the report. Rather, add it as a subnote that it cannot be queried for further analysis.
Generate a report explaining what is contributing the most to log volume. In particular, format the final report as follows (including a table)
### Indexed Log Volume Analysis
#### Recommendations
[2-3 bullet points with recommendations for reducing indexed log volume]
#### Top 20 Log Messages by Indexed Log Volume Count
| Service | Message | Daily Indexed Log Volume Count |
| ... | ... | ... |
| ... | ... | ... |
(Table should be sorted by log volume count and include the top 20 messages with highest log volume count. Divide the 2-day log volume count by 2 to get the daily log volume count.)