Data transfer between filebeat and elasticsearch ingest

Elastic Stack Elasticsearch
1

Hi ,

I have filebeat running on machine A and elasticsearch ingest configured in machine B
While transfering 30 mb data from filebeat , in between when the intermediate status is checked, I get the following size information -

    yellow open   filebeat-2018.06.28 qJCUvo4BSniygGPKSyrv2Q   5   1     232384            0       31mb           31mb
[root@node1 ~]# curl -X GET "node1:9200/_cat/indices/?v"
health status index               uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   filebeat-2018.06.28 qJCUvo4BSniygGPKSyrv2Q   5   1     233531            0       31mb           31mb
[root@node1 ~]#
[root@node1 ~]#
[root@node1 ~]# curl -X GET "node1:9200/_cat/indices/?v"
health status index               uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   filebeat-2018.06.28 qJCUvo4BSniygGPKSyrv2Q   5   1     245743            0     65.5mb         65.5mb
[root@node1 ~]#
[root@node1 ~]#
[root@node1 ~]# curl -X GET "node1:9200/_cat/indices/?v"
health status index               uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   filebeat-2018.06.28 qJCUvo4BSniygGPKSyrv2Q   5   1     246750            0     65.5mb         65.5mb
[root@node1 ~]#
[root@node1 ~]#
[root@node1 ~]#
[root@node1 ~]# curl -X GET "node1:9200/_cat/indices/?v"
health status index

I get to see size upto 65.5mb .. what is the possible reason for this ???

Thanks ,

2

The indexed size will depend on you mappings and how much the data has been enriched. Have a look at this blog post for further details.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.