Hi @lduvnjak
First, what level of license do you have: Basic or Enterprise?
I ask because the majority of disk size savings typically come from the Synthetic Source, which Logsdb uses, but requires an Enterprise license. The sorting has a much lower, though not nonexistent, impact on storage savings compared to the synthetic source.
Thus, I'm a bit confused by your results, Synthetic Source, savings are related to the size and complexity of the source material. You can use the _disk_usage API to validate where the savings are coming from.
Regarding sorting fields, I'm not entirely sure your assumptions are accurate. In short, I would not change the default sorting unless there's a clear reason to do so. I consider what the most likely and consistently present filter will be on the search side.
If you have an Enterprise license, you can route on sorting, but this is an "Expert" only feature, as misapplication can lead to negative consequences like hot-spotting on ingest.
...
EDIT: Sorry re-reading... What are you actually trying to accomplish with the routing... Do you already have synthetic source enabled? Are you trying to just squeeze out more disk space? If you don't get it right and thoroughly test you can introduce negative consequences.