# Index pattern fields - disk space cost?

**URL:** <https://discuss.elastic.co/t/index-pattern-fields-disk-space-cost/233067>\
**Category:** Elasticsearch\
**Created:** [May 18, 2020, 9:00am UTC](https://discuss.elastic.co/t/index-pattern-fields-disk-space-cost/233067 "2020-05-18T09:00:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vdelcampo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vdelcampo/32/65731_2.png) [@vdelcampo](https://discuss.elastic.co/u/vdelcampo)\
**Post date:** [May 18, 2020, 9:00am UTC](https://discuss.elastic.co/t/index-pattern-fields-disk-space-cost/233067/1 "2020-05-18T09:00:40Z")

</div>

Hi.

I´m using logstash to send to elastic all traffic that comes through my load balancer. With logstash, i´m parsing messages in this fields:

 ![Captura](https://us1.discourse-cdn.com/elastic/original/3X/0/f/0fb5e1608b3d9dcc68ab59e06dea7ec0f2de12f3.png)

I parse the http\_request field in other fields depending on the number of params it has: request\_param, request\_type, etc... When i see the index pattern, it has a lot of fields, lot of them are related with those possible request params. I´m not sure if having all this fields cost more disk space in spite not always all these fields are using becase there are to many different http\_request values.

Regards,

Víctor

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 18, 2020, 9:35am UTC](https://discuss.elastic.co/t/index-pattern-fields-disk-space-cost/233067/2 "2020-05-18T09:35:57Z")

</div>

There is a cost, yes. If you have duplicated ones then you can remove them before sending to Elasticsearch.

---

<div class="post-metadata">

**Author:** ![vdelcampo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vdelcampo/32/65731_2.png) [@vdelcampo](https://discuss.elastic.co/u/vdelcampo)\
**Post date:** [May 18, 2020, 12:14pm UTC](https://discuss.elastic.co/t/index-pattern-fields-disk-space-cost/233067/3 "2020-05-18T12:14:35Z")

</div>

I mean not always all http\_request fields are used on each document because there are many differents. In the index pattern fields there are no repetead ones. For example, in index pattern there are fields like these:

request\_param1  
request\_param2  
request\_param3  
request\_param4

For one document, only uses request\_param1 and request\_param2, for the next one request\_param1 and request\_param4. For the first document, are all of them stored in spite of not being used?

Regards

Víctor

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 18, 2020, 9:31pm UTC](https://discuss.elastic.co/t/index-pattern-fields-disk-space-cost/233067/4 "2020-05-18T21:31:04Z")

</div>

Those will be empty fields though, so you can ignore them.

---

<div class="post-metadata">

**Author:** ![vdelcampo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vdelcampo/32/65731_2.png) [@vdelcampo](https://discuss.elastic.co/u/vdelcampo)\
**Post date:** [May 19, 2020, 2:10pm UTC](https://discuss.elastic.co/t/index-pattern-fields-disk-space-cost/233067/5 "2020-05-19T14:10:17Z")

</div>

Thanks a lot Mark.

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2020, 2:10pm UTC](https://discuss.elastic.co/t/index-pattern-fields-disk-space-cost/233067/6 "2020-06-16T14:10:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.