# Multi Fields Diadvantage **URL:** \ **Category:** Elasticsearch\ **Created:** [May 14, 2020, 7:33pm UTC](https://discuss.elastic.co/t/multi-fields-diadvantage/232699 "2020-05-14T19:33:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![saket\_gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saket_gupta/32/53099_2.png) [@saket\_gupta](https://discuss.elastic.co/u/saket_gupta)\ **Post date:** [May 14, 2020, 7:33pm UTC](https://discuss.elastic.co/t/multi-fields-diadvantage/232699/1 "2020-05-14T19:33:31Z")
Hi Team, I am parsing (in logstash using dissect filter) and indexing about 17 fields from a single log message (filebeat -\> logstash -\>ElasticSearch) . Logstash template by default places the parsed string fields as both text and keyword. obviously some fields like loglevel etc wont need to be of type text. I understand that log template can be changed ofcouse, however what are the implications if I dont (let all fields be both text and keyword even if not required) Could My document size get bigger, or any performace issue ? Please explain. ---
**Author:** ![CSharpBender](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/csharpbender/32/50377_2.png) [@CSharpBender](https://discuss.elastic.co/u/CSharpBender)\ **Post date:** [May 14, 2020, 8:43pm UTC](https://discuss.elastic.co/t/multi-fields-diadvantage/232699/2 "2020-05-14T20:43:49Z")
Your index should be bigger and you should experience increased latency during writing and quering. However the document size is not afected. ---
**Author:** ![saket\_gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saket_gupta/32/53099_2.png) [@saket\_gupta](https://discuss.elastic.co/u/saket_gupta)\ **Post date:** [May 15, 2020, 6:24am UTC](https://discuss.elastic.co/t/multi-fields-diadvantage/232699/3 "2020-05-15T06:24:41Z")
> [@CSharpBender](#): > > Your index should be bigger Thanks for your reply. I could not get "Your index should be bigger However the document size is not afected." Request you to please elaborate a bit!! Thanks ---
**Author:** ![Steve\_Mushero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steve_mushero/32/22441_2.png) [@Steve\_Mushero](https://discuss.elastic.co/u/Steve_Mushero)\ **Post date:** [May 16, 2020, 5:04am UTC](https://discuss.elastic.co/t/multi-fields-diadvantage/232699/4 "2020-05-16T05:04:19Z")
We have looked at this, though not deeply, since as far as we can tell, it would nearly double storage for the index, especially on logging with one giant string field. We are looking at using keyword only, but not checked its effects - it does change how/what you can search. Text type is for full text search, which is often desirable for logs messages, as keywords are not broken down. On the flip side, text is kinda useless for other fields like log type, host name, daemon, etc. ---
**Author:** ![CSharpBender](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/csharpbender/32/50377_2.png) [@CSharpBender](https://discuss.elastic.co/u/CSharpBender)\ **Post date:** [May 16, 2020, 10:01am UTC](https://discuss.elastic.co/t/multi-fields-diadvantage/232699/5 "2020-05-16T10:01:10Z")
@saket_gupta the document contains only what you have sent. The mappings define how that data gets parsed and converted into tokens which are used for queries/aggregations. If you define multiple fields the original payload doesn't change but the index would get bigger because you would have the same data analyzed in multiple ways. By default a string field gets mapped as text (standard tokenizer) and keyword. The queries filter the data using the tokens and the result is extracted from the document. Only when you do aggregations you get the key value from the tokens. ---
**Author:** ![saket\_gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saket_gupta/32/53099_2.png) [@saket\_gupta](https://discuss.elastic.co/u/saket_gupta)\ **Post date:** [May 16, 2020, 10:39am UTC](https://discuss.elastic.co/t/multi-fields-diadvantage/232699/6 "2020-05-16T10:39:35Z")
Thanks for your Help!! ---
**Author:** ![saket\_gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saket_gupta/32/53099_2.png) [@saket\_gupta](https://discuss.elastic.co/u/saket_gupta)\ **Post date:** [May 16, 2020, 10:41am UTC](https://discuss.elastic.co/t/multi-fields-diadvantage/232699/7 "2020-05-16T10:41:29Z")
@CSharpBender Thanks for your help. Yes I figured that out as well , after I Posted the Question. But thanks for your Reply ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 13, 2020, 10:41am UTC](https://discuss.elastic.co/t/multi-fields-diadvantage/232699/8 "2020-06-13T10:41:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.