Perform compression in Elasticsearch in a good ratio

Elastic Stack Elasticsearch
1

How can I perform compression in Elasticsearch ?
I tried best_compression but not good at all and also disabled some fields. Wherease Splunk stores index data equal a half of raw data, Elasticsearch stores index data bigger than raw data almost case. Thanks

2

When evaluating storage size, have you done the following:

  • Optimized your mappings according to these guidelines and this blog post.
  • Ensured that you have large shards (> 1 GB) to ensure compression is efficient.
  • Run force merge on the index with max_num_segments set to 1.
  • Looked at how much data you are adding in form of enrichment
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.