internal_memory_size

Estimates the internal memory size of a value in bytes.

internal_memory_size(x:any) -> int

Description

The internal_memory_size function returns an approximate number of bytes that the value x occupies in Tenzir’s internal columnar representation.

The estimate includes non-null primitive values, strings, blobs, records, and lists. Null values don’t contribute to the result.

Examples

Estimate the size of an event

from {
  src_ip: 192.168.1.10,
  msg: "allowed",
  ports: [22, 443],
}
size = internal_memory_size(this)

{
  src_ip: 192.168.1.10,
  msg: "allowed",
  ports: [22, 443],
  size: 39,
}

Measure data flow and forward a summary

Subscribe to a topic, aggregate over a time window, and ship the result to an external system:

subscribe "firewall-events"
summarize start=min(time), end=max(time), size=sum(internal_memory_size(this)),
          options={frequency: 15min}
to_amqp "amqp://user:pass@localhost:5672/"