This page describes how the Metrics powered by Grail - Query DPS capability is consumed and billed. For an overview of the capability, including its main features, see Metrics powered by Grail - Query.
Query usage is based on the volume of uncompressed span data that is scanned during the execution of a DQL query. The unit of measure is gibibytes scanned (GiB scanned).
Querying metrics using the timeseries command is always included.
timeseries avg(dt.host.cpu.usage)
Queries involving other data types generally incur usage at each query, even when they output time series format, for example using the maketimeseries command:
fetch logs | maketimeseries count()
If you frequently use predefined maketimeseries or summarize commands, it might be more cost-effective for you to create a log metric.
Log metrics are regular metrics that are billed for Ingest & Process (and Retain above 15 months), but not for Query.
The above example could be turned into a log metric log.all_logs_count, consuming 525,600 metric data points per year (assuming at least one log record per minute), and the query would then become timeseries sum(log.all_logs_count).
Assuming the equivalent query using logs (fetch logs | maketimeseries count()):
The query usage over the logs version would be 40 GiB * 10 * 365 = 146,000 GiB per year. When multiplied by the Log Management & Analytics – Query price on your rate card, the Metrics powered by Grail – Ingest & Process cost of the log metric is two orders of magnitude less than the Metrics powered by Grail - Query cost of the command using the logs, and even more so if the amount of logs scanned increases (due to longer timeframes, for example).