Disk Usage Tuning

Elastic Stack Elasticsearch
1

Hi,
I want to save disk space for storing syslog data. As I am not interested in full text search I defined the mappings for string fields like this:

"SourceLocation" : {
"type" : "keyword",
},

For testing I indexed the same data with the standard mappings which maps strings as both text and keywords:

"SourceLocation" : {
"type" : "text",
"norms": false,
"index_options": "docs",
"fields" : {
"keyword" : {
"type" : "keyword",
}
}
},

I noticed no difference in needed disk space.
Should not the first variant with only keyword mapping need much less space?

I am using ES 5.6

2

How much data did you index (I would recommend at least a few hundred MB)? How many shards did you use (I would recommend using a single primary shard)? Did you run forcemerge down to 1 segment in order to make a fair comparison?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.