What can you monitor to understand log ingestion performance?

To gain insights into log ingestion performance, monitoring the total number of incoming events is essential. This metric directly indicates the volume of log data being ingested over a specified time period, allowing for assessment of the system's capacity to handle log traffic. A higher number of incoming events could signify an increase in activity or issues within the application, while a drop might suggest problems with log generation or ingestion processes.

In contrast, understanding log ingestion performance isn't directly tied to the processing speed of log data, since it focuses more on throughput than the speed of handling events. The average severity level of log events provides qualitative insights into the issues being logged but does not serve as a direct measure of performance regarding ingestion. Lastly, while knowing the source of log data can help in categorizing and contextualizing logs, it does not specifically inform about the overall performance of the ingestion pipeline. Thus, focusing on the total number of incoming events gives a clearer view of log ingestion performance.