Elasticsearch enrichment, join best practice

Hi,
how would you handle the situation
I have a large data source of 1000tis events/sec, which I need to enrich with data so that I can do analytics on it.

The data source has a small amount of data (i.e. 100bytes) but after enrichment it is huge (1,1kb) per event. Which at 100k events/sec is a significant difference.

Huge amount of data and consumes expensive storage.
Am I doing data enrichment correctly in processing or is it better to use another storage method for this case?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.