# Grok parser efficiency **URL:** \ **Category:** Logstash\ **Created:** [June 26, 2018, 9:37am UTC](https://discuss.elastic.co/t/grok-parser-efficiency/137405 "2018-06-26T09:37:58Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![safhw91](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@safhw91](https://discuss.elastic.co/u/safhw91)\ **Post date:** [June 26, 2018, 9:37am UTC](https://discuss.elastic.co/t/grok-parser-efficiency/137405/1 "2018-06-26T09:37:59Z")
Example portion of my grok parser: match =\> { "message" =\> "(?[^]_) (?._)" } Problem: according to [this](https://www.elastic.co/blog/strings-are-dead-long-live-strings) my string fields are going to be both a "text" and "keyword". I am pretty sure this isn't ideal for memory usage (my use case: 64 GB memory but I'm still afraid of crashes due to tons of data). Suppose I want to optimize the "message" field such that I do not want it to be kept in memory. Which type should I use? Can I do so in the grok parser (going to have hundreds of indexes, so I want a programmatic way to do it)? itself? Thanks!! ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 26, 2018, 9:42am UTC](https://discuss.elastic.co/t/grok-parser-efficiency/137405/2 "2018-06-26T09:42:34Z")
You manage mappings in Elasticsearch through [index templates](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/indices-templates.html), so that is where you need to make the changes. ---
**Author:** ![safhw91](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@safhw91](https://discuss.elastic.co/u/safhw91)\ **Post date:** [June 26, 2018, 9:47am UTC](https://discuss.elastic.co/t/grok-parser-efficiency/137405/3 "2018-06-26T09:47:32Z")
Thanks! I've used that before, and I'll probably have to do that as a last resort. But I wonder if there is a way to do it through grok itself as it will save me a lot of trouble since I have hundreds of indexes to create (currently I'm letting logstash automatically create the index for me) and various other reasons. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 26, 2018, 9:53am UTC](https://discuss.elastic.co/t/grok-parser-efficiency/137405/4 "2018-06-26T09:53:14Z")
No, the data extracted by grok is sent to Elasticsearch as a string or number, and how this is interpreted is determined by the index templates that apply. If you are willing to alter field names, you can however create an index template that manages dynamic mappings based on field prefixes or suffixes. You can then determine the mapping based on how you name the fields, and you could control this when you parse the data, e.g. using grok. You could e.g. map all fields that end with `_k` as a pure keyword field and any field that end with `_kt` as a dual-mapped text/keyword field. ---
**Author:** ![safhw91](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@safhw91](https://discuss.elastic.co/u/safhw91)\ **Post date:** [June 26, 2018, 9:57am UTC](https://discuss.elastic.co/t/grok-parser-efficiency/137405/5 "2018-06-26T09:57:33Z")
> [@Christian\_Dahlqvist](#): > > create an index template that manages dynamic mappings based on field prefixes or suffixes. You can then determine the mapping based on how you name the fields, and you could control this when you parse the data, e.g. using grok. You could e.g. map all fields that end with `_k` as a pure keyword field and any field that end with `_kt` as a dual-mapped text/keyword field. WOW. I have no idea how to do what you're saying, but I will check it up. Explains the issue and exactly how to solve it instead of skirting around... very impressed. Thank you. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 24, 2018, 10:03am UTC](https://discuss.elastic.co/t/grok-parser-efficiency/137405/6 "2018-07-24T10:03:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.