---
title: Logs data streams
description: Logs data streams store log data more efficiently. In benchmarks, logsdb index mode reduced the storage footprint of log data by up to 60%, with a small...
url: https://www.elastic.co/elastic/docs-builder/docs/3016/manage-data/data-store/data-streams/logs-data-stream
products:
  - Elasticsearch
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.0
---

# Logs data streams
Logs data streams store log data more efficiently. In benchmarks, logsdb index mode reduced the storage footprint of log data by up to 60%, with a small impact (10-20%) to indexing performance. Results vary depending on your data set and Elasticsearch version.
Logs data streams are created when the `index.mode` in the relevant template is set to `logsdb`, either automatically or manually.
Logsdb index mode is enabled by default for logs in Elastic Cloud Serverless, and for new logs data streams in Elastic Stack 9.0 and later.

## Availability of logsdb index mode

Logsdb index mode is automatically enabled for the following data streams:
- **Elastic Cloud Serverless:** Logsdb mode is automatically set on new and existing data streams with names matching the `logs-*-*` pattern.
- **Elastic Stack:** Automatic logsdb mode depends on your version and configuration:
  - As of Elasticsearch version 9.0, logsdb mode is automatically set on **new** data streams with names matching the `logs-*-*` pattern.
- In clusters that were upgraded from 8.x to 9.x:
  - If the instance had no existing `logs-*-*` data streams when you upgraded, new `logs-*-*` data streams are set to logsdb mode.
- Existing data streams, including those used for integrations or APM in 8.x instances, are **not** automatically set to logsdb mode.

You can enable logsdb on existing data streams as needed, by editing the relevant [index templates](#logsdb-index-template). For integrations, use [@custom component templates](#logsdb-component-template).

## Enable logsdb index mode

In most cases, you won't need to enable logsdb mode manually. If you do need to enable it, you can either create a new template or update an existing one.
Set `index.mode` to `logsdb` in the relevant [index template](#logsdb-index-template) or [@custom component template](#logsdb-component-template):
- **New data streams:** Create a new template, specifying `logsdb` for the index mode. New data streams matching the template's index pattern use logsdb mode automatically.
- **Existing data streams:** Update the templates the data stream references. Logsdb mode will take effect on the next [rollover](/elastic/docs-builder/docs/3016/manage-data/data-store/data-streams#data-streams-rollover). For integrations, refer to [Enable logsdb for integrations](https://www.elastic.co/elastic/docs-builder/docs/3016/manage-data/data-store/data-streams/logs-data-stream-integrations).


### Set logsdb mode in an index template

<tab-set>
  <tab-item title="Kibana">
    To create or edit an index template in Kibana:
    1. Go to **Index Management** using the navigation menu or the [global search field](https://www.elastic.co/elastic/docs-builder/docs/3016/explore-analyze/find-and-organize/find-apps-and-objects).
    2. On the **Index Templates** tab, click **Create template** to create a new template, or click the name of an existing template to edit it.
       <tip>
       If you have existing templates labeled **Managed**, refer to [Enable logsdb for integrations](https://www.elastic.co/elastic/docs-builder/docs/3016/manage-data/data-store/data-streams/logs-data-stream-integrations) or [Default logs index template](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/observability/logs/logs-index-template-defaults).
       </tip>
    3. Complete the steps in the wizard. In the **Logistics** step:
       - <applies-to>Elastic Cloud Serverless: Generally available</applies-to> Click the **Set index mode** toggle to show the **Index mode** field.
    - Select **LogsDB** as the **Index mode**.
  </tab-item>

  <tab-item title="API">
    To create or update an index template:
    - In an Elastic Stack deployment, use the [create index template](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-index-template) API.
    - In Elastic Cloud Serverless, use the [create index template](https://www.elastic.co/docs/api/doc/elasticsearch-serverless/operation/operation-indices-put-index-template) API.
    First retrieve the current configuration, if any, so you can preserve existing settings. The PUT request **overwrites** any existing template.
    ```json
    ```
    Set `index.mode` to `logsdb` in the template request:
    ```json

    {
      "index_patterns": ["my-data-*"],
      "data_stream": { },
      "template": {
         "settings": {
            "index.mode": "logsdb"
         }
      },
      "priority": 200
    }
    ```
  </tab-item>
</tab-set>


### Set logsdb mode for integrations

To enable logsdb mode for integration data streams, create or update a `@custom` component template for each logs dataset. For details, refer to [Enable logsdb for integrations](https://www.elastic.co/elastic/docs-builder/docs/3016/manage-data/data-store/data-streams/logs-data-stream-integrations).

## Next steps

- [Configure a logs data stream](https://www.elastic.co/elastic/docs-builder/docs/3016/manage-data/data-store/data-streams/logs-data-stream-configure)
- [Review mappings and sorting](/elastic/docs-builder/docs/3016/manage-data/data-store/data-streams/logs-data-stream-configure#logsdb-host-name)
- [Use a data stream](https://www.elastic.co/elastic/docs-builder/docs/3016/manage-data/data-store/data-streams/use-data-stream)
- [Enable logsdb for integrations](https://www.elastic.co/elastic/docs-builder/docs/3016/manage-data/data-store/data-streams/logs-data-stream-integrations)
- [Advanced data source configuration for Elastic Security rules](https://www.elastic.co/elastic/docs-builder/docs/3016/solutions/security/detect-and-alert/advanced-data-source-configuration)