I am parsing (in logstash using dissect filter) and indexing about 17 fields from a single log message (filebeat -> logstash ->ElasticSearch) . Logstash template by default places the parsed string fields as both text and keyword. obviously some fields like loglevel etc wont need to be of type text. I understand that log template can be changed ofcouse, however what are the implications if I dont (let all fields be both text and keyword even if not required)
Could My document size get bigger, or any performace issue ? Please explain.