And how i can optimize size of indices? Should it be done on ES or filebeat side if i have text logs not having json format, but sended using json codec of filebeat?
The size the data takes up in Elasticsearch once indexed depends on how the data is mapped when indexed into Elasticsearch, and can be controlled and optimised through index templates. There is a blog post that discussed this, and even though it is a bit old most of it is still valid.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.