# Elasticsearch 6.4.1 index size reduce

**URL:** <https://discuss.elastic.co/t/elasticsearch-6-4-1-index-size-reduce/160332>\
**Category:** Elasticsearch\
**Created:** [December 11, 2018, 9:31am UTC](https://discuss.elastic.co/t/elasticsearch-6-4-1-index-size-reduce/160332 "2018-12-11T09:31:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![byldozer](https://avatars.discourse-cdn.com/v4/letter/b/b5e925/32.png) [@byldozer](https://discuss.elastic.co/u/byldozer)\
**Post date:** [December 11, 2018, 9:31am UTC](https://discuss.elastic.co/t/elasticsearch-6-4-1-index-size-reduce/160332/1 "2018-12-11T09:31:54Z")

</div>

Hi Everyone,  
got a problem with index size reducing and data optimization.  
Problems for now:

1. by default all text fields duplicated with fieldname and fieldname.keyword. How I can leave just fieldname ? without fieldname.keyword;
2. fields with "type": "keyword" do not have keywords in Kibana filter search. If I got fieldname and fieldname.keyword Kibana filter search works fine;

I found recomendation for ES 5  
"properties": {  
"@version": {  
"type": "keyword",  
"include\_in\_all": false  
},

BUT "include\_in\_all" removed in ES 6.4

I would be grateful for your help

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 11, 2018, 9:49am UTC](https://discuss.elastic.co/t/elasticsearch-6-4-1-index-size-reduce/160332/2 "2018-12-11T09:49:13Z")

</div>

[This](https://www.elastic.co/guide/en/elasticsearch/reference/6.5/tune-for-disk-usage.html) is a good place to start.

---

<div class="post-metadata">

**Author:** ![byldozer](https://avatars.discourse-cdn.com/v4/letter/b/b5e925/32.png) [@byldozer](https://discuss.elastic.co/u/byldozer)\
**Post date:** [December 11, 2018, 12:21pm UTC](https://discuss.elastic.co/t/elasticsearch-6-4-1-index-size-reduce/160332/3 "2018-12-11T12:21:14Z")

</div>

thanks, but it was not a good advice.  
I found solution -

GET /\_template/logs  
{  
"logs": {  
"order": 0,  
"index\_patterns": [  
"log-\*"  
],  
"settings": {  
"index": {  
"number\_of\_shards": "1"  
}  
},  
"mappings": {  
"doc": {  
"properties": {  
"@timestamp": {  
"type": "date"  
},  
"Method": {  
"type": "keyword",  
"ignore\_above": 256  
},  
"Service": {  
"type": "keyword",  
"ignore\_above": 256  
},  
"User": {  
"type": "keyword",  
"ignore\_above": 256  
},  
"body": {  
"type": "text",  
"norms": false  
},  
"ip": {  
"type": "keyword",  
"ignore\_above": 256  
}  
},  
"\_all": {  
"enabled": false  
},  
"dynamic\_templates": [  
{  
"string\_fields": {  
"match\_mapping\_type": "string",  
"mapping": {  
"type": "keyword",  
"norms": false  
}  
}  
}  
]  
}  
},  
"aliases": {}  
}  
}

maybe I can optimise it more?

---

<div class="post-metadata">

**Author:** ![byldozer](https://avatars.discourse-cdn.com/v4/letter/b/b5e925/32.png) [@byldozer](https://discuss.elastic.co/u/byldozer)\
**Post date:** [December 11, 2018, 12:44pm UTC](https://discuss.elastic.co/t/elasticsearch-6-4-1-index-size-reduce/160332/4 "2018-12-11T12:44:52Z")

</div>

> [@byldozer](#):
>
> ip

Notice another problem - ip does not have pop up values in Kibana.  
Any ideas why?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2019, 12:45pm UTC](https://discuss.elastic.co/t/elasticsearch-6-4-1-index-size-reduce/160332/5 "2019-01-08T12:45:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.