2.x change to 6.x agg bug or not，what can i do？

[CSuperC (CC)]

our 2.x agg very good，bug agg 6.x is worst
one day 3kw logs，then agg logs by a,b,c,d, very well in 2.x，when use in 6.x ，server is bad ，out of memery
2.x and 6.x java heap is almost the same ，6.x is more heap
one day in 2.x index size is 50GB，but 100GB in 6.x，is it the reason，when 6.x go down？，if this is the question ，what can i do to decrease the index in 6.x version 6.7.1 version 2.4.5

[dadoonet (David Pilato)]

You should try with 7.x.
6.x is already very different from 2.x so that might explain what you are seeing, specifically in term of disk space.
Keyword datatype now uses doc_values (on disk) instead of fielddata (on memory).

If you need help, you need to share more about what you are doing. Like a typical query and a typical response from elasticsearch.

[CSuperC (CC)]

thank you very much for you first reply ,i will write more info,you say,
Keyword datatype now uses doc_values (on disk) instead of fielddata (on memory).
but i look in 2.x docs, text ( not_analyzed) use doc_values the same

String datatype | Elasticsearch Reference [2.4] | Elastic

,i can give template,template is here in 2.x
{
"order": 0,
"template": "user_active_",
"settings": {
"index": {
"number_of_replicas": "1",
"number_of_shards": "5",
"refresh_interval": "120s"
}
},
"mappings": {
"default": {
"all": {
"enabled": false
}
},
"user_active_detail": {
"date_detection": false,
"properties": {
"result": {
"index": "not_analyzed",
"type": "string"
},
"systemName": {
"index": "not_analyzed",
"type": "string"
},
"sourcePort": {
"type": "integer"
},
"destIp": {
"index": "not_analyzed",
"type": "string"
},
"endTime": {
"type": "long"
},
"business": {
"index": "not_analyzed",
"type": "string"
},
"id": {
"type": "string"
},
"cardNo": {
"index": "not_analyzed",
"type": "string"
},
"response": {
"ignore_above": 256,
"analyzer": "ik_max_word",
"type": "string"
},
"time": {
"type": "long"
},
"networkCode": {
"index": "not_analyzed",
"type": "string"
},
"responseType": {
"type": "string"
},
"keyWords": {
"ignore_above": 256,
"analyzer": "ik_smart",
"type": "string"
},
"systemId": {
"index": "not_analyzed",
"type": "string"
},
"networkName": {
"index": "not_analyzed",
"type": "string"
},
"responseTime": {
"type": "long"
},
"module": {
"index": "not_analyzed",
"type": "string"
},
"policeId": {
"index": "not_analyzed",
"type": "string"
},
"sn": {
"index": "not_analyzed",
"type": "string"
},
"terminalIp": {
"index": "not_analyzed",
"type": "string"
},
"requestId": {
"type": "string"
},
"extend": {
"type": "nested"
},
"imei": {
"index": "not_analyzed",
"type": "string"
},
"params": {
"analyzer": "ik_max_word",
"type": "string"
},
"uri": {
"index": "not_analyzed",
"type": "string"
},
"url": {
"index": "not_analyzed",
"type": "string"
},
"content": {
"index": "not_analyzed",
"ignore_above": 256,
"type": "string"
},
"errorLog": {
"index": "not_analyzed",
"type": "string"
},
"source": {
"index": "not_analyzed",
"type": "string"
},
"sessionId": {
"index": "not_analyzed",
"type": "string"
},
"errorCode": {
"index": "not_analyzed",
"type": "string"
},
"sourceIp": {
"index": "not_analyzed",
"type": "string"
},
"bizType": {
"type": "string"
},
"formatParam": {
"index": "not_analyzed",
"ignore_above": 256,
"type": "string"
},
"destPort": {
"type": "integer"
},
"logType": {
"index": "not_analyzed",
"type": "string"
}
}
}
},
"aliases": {
"user-active": {}
}
}
and 6.x tempalte
{
"index_patterns": "user_active",
"settings": {
"index": {
"number_of_shards": "5",
"number_of_replicas": "1",
"refresh_interval": "120s"
}
},
"mappings": {
"default": {
"_all": {
"enabled": false
}
},
"user_active_detail": {
"date_detection": false,
"properties": {
"destIp": {
"type": "keyword"
},
"logType": {
"type": "keyword"
},
"policeId": {
"type": "keyword"
},
"sourcePort": {
"type": "integer"
},
"formatParam": {
"ignore_above": 256,
"type": "keyword"
},
"bizType": {
"type": "keyword"
},
"networkName": {
"type": "keyword"
},
"errorCode": {
"type": "keyword"
},
"source": {
"type": "keyword"
},
"cardNo": {
"type": "keyword"
},
"content": {
"ignore_above": 256,
"type": "keyword"
},
"result": {
"type": "keyword"
},
"responseType": {
"type": "keyword"
},
"destPort": {
"type": "integer"
},
"systemName": {
"type": "keyword"
},
"requestId": {
"type": "keyword"
},
"id": {
"type": "keyword"
},
"sn": {
"type": "keyword"
},
"keyWords": {
"analyzer": "ik_smart",
"type": "text"
},
"systemId": {
"type": "keyword"
},
"responseTime": {
"type": "long"
},
"module": {
"type": "keyword"
},
"errorLog": {
"type": "keyword"
},
"sessionId": {
"type": "keyword"
},
"params": {
"analyzer": "ik_max_word",
"type": "text"
},
"uri": {
"type": "keyword"
},
"url": {
"type": "keyword"
},
"sourceIp": {
"type": "keyword"
},
"response": {
"analyzer": "ik_max_word",
"type": "text"
},
"networkCode": {
"type": "keyword"
},
"endTime": {
"type": "long"
},
"time": {
"type": "long"
},
"terminalIp": {
"type": "keyword"
},
"business": {
"type": "keyword"
},
"imei": {
"type": "keyword"
},
"extend": {
"type": "nested"
}
}
}
},
"aliases": {
"user_active_detail": {}
}
}