LogsDB FAQ
Common questions about Elasticsearch LogsDB index mode, storage savings, and query performance.
LogsDB is a new index mode introduced in Elasticsearch 8.15 that offers significant storage savings compared to the standard index mode data stream.
There is a slight CPU impact during ingestion, but the benefits typically outweigh this minor drawback.
The storage savings from LogsDB can translate to 40–60% savings on cloud licensing and substantial reductions in node count for on-premise deployments. By reducing data volume by up to 50%, LogsDB can significantly lower TCO for both cloud and on-premise Elasticsearch deployments.
For Palo Alto Firewall Logs, standard index mode uses about 550 bytes per document, while LogsDB mode reduces this to just 220 bytes per document.
While results may vary, testing with many data sources has shown consistent benefits. Additional benefits can be realized by adding fields to sort on.
When configured with LZ4 compression instead of the default DEFLATE, LogsDB can actually improve query performance, especially for aggregations.
Testing has shown LZ4 compression with LogsDB results in ~1% less compression than the default of DEFLATE (best_compression), but can provide better query performance.
In one test, an aggregation query on LogsDB with LZ4 compression completed in 2.2 seconds, compared to 2.9 seconds with default compression and 2.7 seconds in standard mode.