Elasticsearch Logsdb Index Mode to Reduce Log Data Storage Footprint by Up to 65%
Security and observability teams benefit from reduced storage expenses and longer log retention to support their threat hunting, incident response, and compliance requirements.
This is a Press Release edited by StorageNewsletter.com on December 18, 2024 at 2:01 pmElastic announced the general availability of Elasticsearch logsdb index mode.
This latest innovation in log management reduces the storage footprint of log data by up to 65% compared to recent versions of Elasticsearch without logsdb index mode. Now, security and observability teams have increased visibility while keeping all data immediately accessible for analysis.
“Logs are critical for detection and remediation, but the growing log volume generated by infrastructure and applications is driving up costs and forcing compromises that hinder analysis,” said Ken Exner, CPO, Elastic. “Logsdb index mode reduces the disk footprint and overall cost of storing log data with features including smart index sorting, synthetic source and advanced compression.”
Logsdb index mode optimizes data ordering, eliminates duplication by reconstructing non-stored field values with synthetic _source, and improves compression with advanced algorithms and codecs.
Key benefits include:
- Reduced costs: enables organizations to reduce storage expenses while retaining more data, saving costs across all storage tiers.
- Preservation of valuable data: retains all log data using features like synthetic _source, improving operational efficiency without relying on extra tools or filters.
- Expanded visibility: provides access to all data on one platform without separate silos for various data, accelerating problem resolution, investigation, and remediation for site reliability engineers (SREs) and security operations center (SOC) teams.
- Streamlined access to data: retains actionable data efficiently, enabling troubleshooting, trending and analysis for SRE teams, and allows SOC teams to swiftly search all of their data for investigation and threat hunting.
Availability:
Logsdb index mode is generally available for Cloud Hosted and Self-Managed customers starting in version 8.17 and is enabled by default for logs in Elastic Cloud Serverless.
Basic logsdb index mode capabilities are available to organizations with Standard, Gold, and Platinum licenses. Complete logsdb index mode capabilities are available to Serverless customers as well as organizations with an Enterprise license.
Resources:
Start free trial now
Blog: Elastic 8.17: Elasticsearch logsdb index mode, Elastic Rerank, and more
Subscribe to our free daily newsletter
