Updating ELK causes triple write IOPS

Good point. There is more data going into doc values, which increase the size of those data types, but at the same time you no longer index a _all field, which will save a lot of space. If you use the best compression codec you could save even more space.

One thing that has changed between 1.x and 6.x is that the transaction log is synced to disk much more frequently in order to improve resiliency, but I am not sure what impact this could have on the reported IOPS.