Does Elasticsearch automatically compress? Yes. The default compression is LZ4, but you can use DEFLATE, which is higher compression at the cost of more CPU to compress further, and a slightly slower indexing rate.
With regards to space, the first big thing I notice is that the translogs seem to be clearing themselves out—just like they're supposed to. The translog (transaction log) keeps a running record of things being indexed. Those entries are purged out of the translog after they have been verified to have been added to Elasticsearch. This process is transparent to the user, and runs continuously, so long as new data is being added to Elasticsearch.
For your purposes, consider the disk space needed as something in the vein of FIFO space for things coming in, that will empty as soon as it can. You may need to plan for that space to balloon and shrink as noted above.