I want to create a dashboard that displays the log volume for each asset using Native Dashboard.

If you know all the hostnames you can use a ref list.  If you have a ref list where you can use a regex identifier, I believe you could use that in your query and the results would point to your hostname 

You'd need to create a hostname variable $hostname = principal.hostname and then match on $hostname too.  

Hello,

Thank you for your reply.
I understand that it is not currently possible to aggregate logs by host name.
Thank you very much.

If you have enabled silent host monitoring, you can look up ingestion metrics in the API using a query like this:

ingestion.log_type != ""
ingestion.component = "Ingestion API"
$log_types = ingestion.log_type
$log_sources = ingeston.ingestion_source
match:
   $log_types, $log_sources
outcome:
   $size_GB = math.round(sum(ingestion.log_volume) / (1024 * 1024 * 1024), 1)
order:
   $size_GB desc
limit:
   50

However, we need to verify the ingestion_source attribute in Ingestion Metrics.

refs:

https://cloud.google.com/chronicle/docs/reference/ingestion-metrics-schema#ingestion_api_schema

https://medium.com/@thatsiemguy/native-dashboards-preview-in-chronicle-siem-eacb3e0824f3

https://docs.bindplane.com/how-to-guides/google-secops/google-secops-silent-host-monitoring