Using best_compression does have some impact on indexing performance, but does compress the source a lot better and can save a significant amount of disk space. Disabling the _all field will also save space if you do not need it. If you have fields that do not need to be aggregated upon or be subject to free-text search, you can also slimline the default Logstash mappings and not have all fields dual-mapped. I discussed these topics and the trade-offs in blog post.