# Optimizing elasticsearch index **URL:** \ **Category:** Elasticsearch\ **Created:** [February 2, 2018, 10:01pm UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-index/118289 "2018-02-02T22:01:45Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![imortalsolitude](https://avatars.discourse-cdn.com/v4/letter/i/6f9a4e/32.png) [@imortalsolitude](https://discuss.elastic.co/u/imortalsolitude)\ **Post date:** [February 2, 2018, 10:01pm UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-index/118289/1 "2018-02-02T22:01:45Z")
Are there any articles on how to optimize elastic search index in 6.1, currently with the default setting and 600 MB of syslog data my index size is around 1.7G this is way larger than the actual file size. I disabled \_all fields, remove unwanted fields that has been created by "geoip" and "agent" parsing, enabled best\_compression this brought down the file size to 1.72G from 1.85G is there any other setting that can get the index size to reduce? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 3, 2018, 1:09am UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-index/118289/2 "2018-02-03T01:09:37Z")
What's your mapping look like? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [February 3, 2018, 10:27am UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-index/118289/3 "2018-02-03T10:27:01Z")
Are you using the default dual text/keyword mapping or have you optimised this? How much extra data are you adding to the event through enrichment, e.g. geoip and user agent processing. Have you run a forcemerge on the index to reduce the number of segments to 1? ---
**Author:** ![imortalsolitude](https://avatars.discourse-cdn.com/v4/letter/i/6f9a4e/32.png) [@imortalsolitude](https://discuss.elastic.co/u/imortalsolitude)\ **Post date:** [February 5, 2018, 6:07pm UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-index/118289/4 "2018-02-05T18:07:49Z")
Here's how my [Index Mapping](https://pastebin.com/XBHS3XZp) looks like ---
**Author:** ![imortalsolitude](https://avatars.discourse-cdn.com/v4/letter/i/6f9a4e/32.png) [@imortalsolitude](https://discuss.elastic.co/u/imortalsolitude)\ **Post date:** [February 5, 2018, 6:08pm UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-index/118289/5 "2018-02-05T18:08:56Z")
> [@Christian\_Dahlqvist](#): > > ng to the event through enrichment, e. Geo IP is definitely being added to the data. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [February 5, 2018, 6:20pm UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-index/118289/6 "2018-02-05T18:20:58Z")
It looks like you are using the default mapping for most fields, which means that all text fields are stored in analysed form for free text search as well as keyword. This gives you a lot of flexibility, but will take up more space . You can read about how to address this [in the documentation](https://www.elastic.co/guide/en/elasticsearch/reference/6.1/tune-for-disk-usage.html). ---
**Author:** ![imortalsolitude](https://avatars.discourse-cdn.com/v4/letter/i/6f9a4e/32.png) [@imortalsolitude](https://discuss.elastic.co/u/imortalsolitude)\ **Post date:** [February 7, 2018, 12:50am UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-index/118289/7 "2018-02-07T00:50:00Z")
Thanks that helped got the index size to drop by around 20% ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 7, 2018, 12:50am UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-index/118289/8 "2018-03-07T00:50:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.