# Storing logs: 'message' field doubles index size?

**URL:** <https://discuss.elastic.co/t/storing-logs-message-field-doubles-index-size/73263>\
**Category:** Logstash\
**Created:** [January 30, 2017, 6:46pm UTC](https://discuss.elastic.co/t/storing-logs-message-field-doubles-index-size/73263 "2017-01-30T18:46:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![John16](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@John16](https://discuss.elastic.co/u/John16)\
**Post date:** [January 30, 2017, 6:46pm UTC](https://discuss.elastic.co/t/storing-logs-message-field-doubles-index-size/73263/1 "2017-01-30T18:46:52Z")

</div>

Hello,

I am using filebeat + logstash to store logs in ES.  
When I browse my index data, I see structured fields my log lines are parsed into (date, http return code, request line, etc) as well as 'message' field which represents the whole log line itself.

So as far as I understand, every log line is stored twice: first time in structured format, and second time as a whole in 'message' field.

Why? Is it possible to get rid of this duplication and to trim that 'message' in order to save some disk space?

Thanks.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 30, 2017, 7:21pm UTC](https://discuss.elastic.co/t/storing-logs-message-field-doubles-index-size/73263/2 "2017-01-30T19:21:45Z")

</div>

You can add a mutate filter and [remove the message field](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-remove_field) in Logstash. If you would like to keep it, but do not need to be able to search it, you can alter the index template and set the message field to be not indexed, which probably will save a fair amount of space.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2017, 7:22pm UTC](https://discuss.elastic.co/t/storing-logs-message-field-doubles-index-size/73263/3 "2017-02-27T19:22:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.