ES提高数据压缩的设置——单字段，去掉source和all

curl -XPUT 'http://localhost:9200/hec_test3' -d '
{
  "mappings": {
    "hec_type3": {
            "_source": {
                "enabled": false
            },
            "_all": {
                "enabled": false
            },
            "properties": {
                "event": {
                    "type": "string",
                    "store": "yes",
                    "include_in_all": false,
                    "doc_values": false,
                    "index_options": "docs"
                }
            }
        }
  }
}
'

此外，强制merge也可以大大降低索引的大小！

curl -XPOST 'localhost:9200/hec_test3/_forcemerge'