I am trying to create a TopList visualization or alternatively a Query to view all services ingesting logs that are not in JSON format.
I am able to find all services ingesting logs in any format using:
sum:datadog.estimated_usage.logs.ingested_events{*,*,$service,$datadog_index} by {service}.as_count()
Will be great if I can trim this down to those ingesting non json logs.
