# Field Aliases vs Copy **URL:** \ **Category:** Elasticsearch\ **Tags:** ecs-elastic-common-schema\ **Created:** [March 11, 2020, 10:52am UTC](https://discuss.elastic.co/t/field-aliases-vs-copy/223102 "2020-03-11T10:52:51Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Post date:** [March 11, 2020, 10:52am UTC](https://discuss.elastic.co/t/field-aliases-vs-copy/223102/1 "2020-03-11T10:52:51Z")
Hi Team, We are planning to use Wazuh for some of our monitoring needs. Wazuh does not support ECS. Now, I plan to make the Wazuh data ECS compliant for better monitoring! My question is, which of the following would be a better option and why? What impact would they have from a performance perspective? - Create an Alias for all Wazuh fields - Copy the Wazuh fields into ECS compliant field names A thing to consider is that Wazuh logs are quite varied and will probably need to create a table for well over 20-30 fields! Each log line will have a minimum of 10-15 fields. So adding a new field would probably double the storage needs, but would aliases lead to a performace hit when you have like Billions of messages? Cheers! ---
**Author:** ![webmat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webmat/32/46191_2.png) [@webmat](https://discuss.elastic.co/u/webmat)\ **Post date:** [March 11, 2020, 12:45pm UTC](https://discuss.elastic.co/t/field-aliases-vs-copy/223102/2 "2020-03-11T12:45:08Z")
I would absolutely recommend copying the fields rather than creating field aliases. Field aliases are not a perfect replacement to having the data in the expected ECS fields. Read the sections "Resolve schema differences and conflicts" and the section "Aliases" in this blog post, where I go in depth about this: > **[Migrating to Elastic Common Schema (ECS) in Beats environments](https://www.elastic.co/blog/migrating-to-elastic-common-schema-in-beats-environments)** > > Find out how to migrate to the Elastic Common Schema (ECS) in a Beats environment (after upgrading Elasticsearch and Kibana to version 7.x). Get tips on preparation and strategy, and see a walkthrough of a n example migration. Don't worry about having 20-30 more fields, Elasticsearch can handle a lot more than that 🙂 ---
**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Post date:** [March 12, 2020, 6:30am UTC](https://discuss.elastic.co/t/field-aliases-vs-copy/223102/3 "2020-03-12T06:30:11Z")
Thanks @webmat! That was pretty detailed! A quick follow-up, was my assumption that my disk requirements be roughly doubled when I copy the fields to ECS complied fields correct? ---
**Author:** ![webmat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webmat/32/46191_2.png) [@webmat](https://discuss.elastic.co/u/webmat)\ **Post date:** [March 12, 2020, 12:40pm UTC](https://discuss.elastic.co/t/field-aliases-vs-copy/223102/4 "2020-03-12T12:40:58Z")
I don't think it's as linear or straightforward, since the data is sliced and diced in so many ways by Elasticsearch. One of the things you can experiment with is your mapping / index template's `codec` parameter. Read up on it [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/index-modules.html#index-codec) You can also read up on multiple other strategies to tune disk usage [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/tune-for-disk-usage.html). But I'd suggest you test the two approaches (alias only vs copy) with a few thousand documents in two different indices, and compare their size, before going into too much premature tuning 🙂 ---
**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Post date:** [March 13, 2020, 4:53am UTC](https://discuss.elastic.co/t/field-aliases-vs-copy/223102/5 "2020-03-13T04:53:47Z")
Already using the `best_compression` codec in prod. 🙂 Well, I guess I'll try with a smaller data set and see. Thanks Mathieu! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 10, 2020, 4:53am UTC](https://discuss.elastic.co/t/field-aliases-vs-copy/223102/6 "2020-04-10T04:53:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.