These two panels are supposed to show the "daily log volume" being collected and sent to the output, respectively.

While I can not gauge this with experience from a real cluster, so far I have only observed these graphs to be really inaccurate.

I think the underlying issue is that there is a misconception that increase() actually counts the difference observed in the timerange specified.

But this is not what increase does, it's just "rate multiplied by time", so in this case it's equivalent to rate([24h]) * 86400. So it's not "total number of bytes" but "average rate per second for the last 24h multiplied by number of seconds in a day", which does not match the expectation customers have when reading the title of the panel.

I think it would be better to just show the collection / send rates instead, which is what the panels below are doing.