# What would be the best way to store and query large binary files in ES?

**URL:** https://discuss.elastic.co/t/what-would-be-the-best-way-to-store-and-query-large-binary-files-in-es/35807
**Category:** Elasticsearch
**Created:** [November 28, 2015, 3:23pm UTC](https://discuss.elastic.co/t/what-would-be-the-best-way-to-store-and-query-large-binary-files-in-es/35807 "2015-11-28T15:23:06Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![ankmathur14](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@ankmathur14](https://discuss.elastic.co/u/ankmathur14)
#### Post date: [November 28, 2015, 3:23pm UTC](https://discuss.elastic.co/t/what-would-be-the-best-way-to-store-and-query-large-binary-files-in-es/35807/1 "2015-11-28T15:23:06Z")

</div>

Hello all ,

I want to store large binary files (like xyz.exe, pqr.exe) into ES and search/query for particular binary patterns into these files.

e.g  
data = 4DBEEF3B305367C9AEB8DBA22E3CD0ADB8EBB75C829E68DD8EEDDBA5EE5301FC2A2E087C952D325124F3B62AD548D7CD6C2C633F10E57686C6AE288476C0849985F3BE6C7CF19A48992FA121845FA3

```
search/query for = 829E68DD8EEDDBA

```

TO STORE

1. I am trying make use of attachment plugin to store its base64 encoded data.  
{  
"test": {  
"mappings": {  
"logs": {  
"properties": {  
"file": {  
"type": "attachment"  
}  
}  
}  
}  
}  
}

ALSO

1. I am trying to store data as a string ( 4DBEEF3B305367C9AEB8DBA22E3CD......) in one field.  
{  
"test": {  
"mappings": {  
"logs": {  
"properties": {  
"file": {  
"type": "string"  
}  
}  
}  
}  
}  
}

TO SEARCH

1. I am trying "wildcard" search/query.  
GET test/logs/\_search  
{  
"query": {  
"wildcard": {  
"file" : "_829E68DD8EEDDBA_"  
}  
}  
}

ALSO

1. I am trying "query\_string" search/query.  
GET test/logs/\_search  
{  
"query": {  
"query\_string": {  
"query" : "_829E68DD8EEDDBA_"  
}  
}  
}

I have managed to get expected results but these queries are taking very LONG time on big index.

What would be the alternative way to this use case.  
Should i go for "N-Gram" analyzer for this use case or any other way to make search faster??  
I am planning to store 1 Million binaries each of size (1KB to 1 MB).

Any help/hint would be appreciated.

Thanks.  
Ankur Mathur

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:35pm UTC](https://discuss.elastic.co/t/what-would-be-the-best-way-to-store-and-query-large-binary-files-in-es/35807/2 "2017-07-05T23:35:11Z")

</div>