# Analyzed string can use a lot of memory to visualize

**URL:** <https://discuss.elastic.co/t/analyzed-string-can-use-a-lot-of-memory-to-visualize/26492>\
**Category:** Kibana\
**Created:** [July 29, 2015, 2:36pm UTC](https://discuss.elastic.co/t/analyzed-string-can-use-a-lot-of-memory-to-visualize/26492 "2015-07-29T14:36:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![saif](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saif/32/37431_2.png) [@saif](https://discuss.elastic.co/u/saif)\
**Post date:** [July 29, 2015, 2:36pm UTC](https://discuss.elastic.co/t/analyzed-string-can-use-a-lot-of-memory-to-visualize/26492/1 "2015-07-29T14:36:23Z")

</div>

Hi im using rsyslog+ES+kibana  
es on 3 servers cluster  
after 10 days my kibana work but its very slow

 ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e96129e4e84a5e846ae71132cbfcbc749c34fb8b.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d2b9234323ca9b71a4fd62614b2fbb8742a3fef5.png)

i think that the analyzed fileds use lot of memory .. there is any solution  
i used ES to index logs from Rsyslog 2000 network equipment  
thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 29, 2015, 10:53pm UTC](https://discuss.elastic.co/t/analyzed-string-can-use-a-lot-of-memory-to-visualize/26492/2 "2015-07-29T22:53:16Z")

</div>

Turn them into not analysed and use doc values.

The problem isn't that KB is slow, it'll be that ES is slowing down due to the amount of data you have and are querying. You should be monitoring it to see what is happening.

---

<div class="post-metadata">

**Author:** ![saif](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saif/32/37431_2.png) [@saif](https://discuss.elastic.co/u/saif)\
**Post date:** [July 30, 2015, 8:11am UTC](https://discuss.elastic.co/t/analyzed-string-can-use-a-lot-of-memory-to-visualize/26492/3 "2015-07-30T08:11:26Z")

</div>

thank you  
"mappings": {  
"_default_": {  
"\_all": {  
"enabled": false  
},  
"properties": {

```
 "@timestamp": {
                "type": "date",
                "index": "not_analyzed",
                "doc_values": true
            },
            "host": {
                "type": "string",
                "index": "not_analyzed",
                "doc_values": true
            },
            "severity": {
                "type": "string",
                "index": "not_analyzed",
                "doc_values": true
            },
            "facility": {
                "type": "string",
                "index": "not_analyzed",
                "doc_values": true
            },
            "syslogtag": {
                "type": "string",
                "index": "not_analyzed",
                "doc_values": true
            },
            "message": {
                "type": "string",
                "index": "analyzed"

            }

```

like that ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 30, 2015, 10:59pm UTC](https://discuss.elastic.co/t/analyzed-string-can-use-a-lot-of-memory-to-visualize/26492/4 "2015-07-30T22:59:53Z")

</div>

Yep 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:15pm UTC](https://discuss.elastic.co/t/analyzed-string-can-use-a-lot-of-memory-to-visualize/26492/5 "2017-07-06T14:15:31Z")

</div>