# Find large messages **URL:** \ **Category:** Elasticsearch\ **Created:** [May 17, 2016, 6:02pm UTC](https://discuss.elastic.co/t/find-large-messages/50247 "2016-05-17T18:02:57Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![jchen](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@jchen](https://discuss.elastic.co/u/jchen)\ **Post date:** [May 17, 2016, 6:02pm UTC](https://discuss.elastic.co/t/find-large-messages/50247/1 "2016-05-17T18:02:57Z")
Is there an easy way to figure how the messages being put into ES based on their size? We are seeing a sudden increase in the storage space consumed and believe it's related continuous large messages being dumped into the cluster. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 18, 2016, 5:26am UTC](https://discuss.elastic.co/t/find-large-messages/50247/2 "2016-05-18T05:26:28Z")
There is [https://www.elastic.co/guide/en/elasticsearch/plugins/current/mapper-size.html](https://www.elastic.co/guide/en/elasticsearch/plugins/current/mapper-size.html) ---
**Author:** ![jchen](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@jchen](https://discuss.elastic.co/u/jchen)\ **Post date:** [May 31, 2016, 11:22pm UTC](https://discuss.elastic.co/t/find-large-messages/50247/3 "2016-05-31T23:22:15Z")
Trying to understand what is the correct process to take to get this working in Graylog running on ES data nodes. The current state of my configuration - I have the index configured in Graylog and ES as "graylog" after I have everything installed. - I installed the mapper size plugin installed on the ES nodes. - I have the cluster online with Graylog input running. - I am able to generate test GELF UDP inputs and have the cluster accept the log message. At this point, from what I've read, I need to create a new index with mapper size "\_size" field added to the mapping? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:47pm UTC](https://discuss.elastic.co/t/find-large-messages/50247/4 "2017-07-05T22:47:29Z")