# Weird storage change

**URL:** <https://discuss.elastic.co/t/weird-storage-change/90474>\
**Category:** Elasticsearch\
**Created:** [June 22, 2017, 2:07pm UTC](https://discuss.elastic.co/t/weird-storage-change/90474 "2017-06-22T14:07:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![hding](https://avatars.discourse-cdn.com/v4/letter/h/eb9ed0/32.png) [@hding](https://discuss.elastic.co/u/hding)\
**Post date:** [June 22, 2017, 2:07pm UTC](https://discuss.elastic.co/t/weird-storage-change/90474/1 "2017-06-22T14:07:18Z")

</div>

I'm trying to index a log file of size 1.4GB. The compressed version is 0.3GB.

The log lines have 77 fields, separated by whitespaces. I'm only indexing 5 of them, without storing them.

If I do not store the original log lines, the index data will be 0.3GB.

If I store the original log lines, the index data will be 2.1GB.

Why the difference (1.8GB) is so huge and even larger than the uncompressed log file (1.4GB)?

---

<div class="post-metadata">

**Author:** ![hding](https://avatars.discourse-cdn.com/v4/letter/h/eb9ed0/32.png) [@hding](https://discuss.elastic.co/u/hding)\
**Post date:** [June 22, 2017, 7:41pm UTC](https://discuss.elastic.co/t/weird-storage-change/90474/2 "2017-06-22T19:41:36Z")

</div>

Has anyone encountered similar problems before? It looks to me that ES is not storing things efficiently and storage can be a huge issue.

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [June 22, 2017, 7:56pm UTC](https://discuss.elastic.co/t/weird-storage-change/90474/3 "2017-06-22T19:56:37Z")

</div>

Check your mapping. If there are that many spaces in that field, and it's mapped as text, it's being analyzed and tokenized for plain-text search. That could account for some of it.

---

<div class="post-metadata">

**Author:** ![hding](https://avatars.discourse-cdn.com/v4/letter/h/eb9ed0/32.png) [@hding](https://discuss.elastic.co/u/hding)\
**Post date:** [June 22, 2017, 8:09pm UTC](https://discuss.elastic.co/t/weird-storage-change/90474/4 "2017-06-22T20:09:04Z")

</div>

Actually I have set the raw log line field to be a "keyword". I also set { "index": False }. Storage is still huge.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2017, 8:09pm UTC](https://discuss.elastic.co/t/weird-storage-change/90474/5 "2017-07-20T20:09:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.