---
title: Logs data streams
description: Logs data streams store log data more efficiently. In benchmarks, logsdb index mode reduced the storage footprint of log data by up to 60%, with a small...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8263/manage-data/data-store/data-streams/logs-data-stream
products:
  - Elasticsearch
applies_to:
  - Serverless Elasticsearch projects: Generally available
  - Serverless Observability projects: Generally available
  - Serverless Security projects: Generally available
  - Serverless Elasticsearch Vector Database projects: Unavailable
  - Elastic Stack: Generally available since 9.0
---

# Logs data streams
Logs data streams store log data more efficiently. In benchmarks, logsdb index mode reduced the storage footprint of log data by up to 60%, with a small impact (10-20%) to indexing performance. Results vary depending on your data set and Elasticsearch version.
Logs data streams are created when the `index.mode` in the relevant template is set to `logsdb`, either automatically or manually.
Logsdb index mode is enabled by default for logs in Elasticsearch, Observability, and Security Serverless projects, and for new logs data streams in Elastic Stack 9.0 and later.
<note applies-to="Elastic Cloud Serverless: Preview, Elastic Stack: Preview since 9.5">
  <applies-to>Serverless Elasticsearch Vector Database projects: Unavailable</applies-to> For a fully columnar logs storage profile, you can set `index.mode` to `logsdb_columnar` instead. To learn when to choose that mode, refer to [Columnar index mode](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8263/manage-data/data-store/columnar).
</note>


## Availability of logsdb index mode

Logsdb index mode is automatically enabled for the following data streams:
- **Elasticsearch, Observability, and Security Serverless projects:** Logsdb mode is automatically set on new and existing data streams with names matching the `logs-*-*` pattern.
- **Elastic Stack:** Automatic logsdb mode depends on your version and configuration:
  - As of Elasticsearch version 9.0, logsdb mode is automatically set on **new** data streams with names matching the `logs-*-*` pattern.
- In clusters that were upgraded from 8.x to 9.x:
  - If the instance had no existing `logs-*-*` data streams when you upgraded, new `logs-*-*` data streams are set to logsdb mode.
- Existing data streams, including those used for integrations or APM in 8.x instances, are **not** automatically set to logsdb mode.

You can enable logsdb on existing data streams as needed, by editing the relevant [index templates](#logsdb-index-template). For integrations, use [@custom component templates](#logsdb-component-template).

## Enable logsdb index mode

In most cases, you won't need to enable logsdb mode manually. If you do need to enable it, you can either create a new template or update an existing one.
Set `index.mode` to `logsdb` in the relevant [index template](#logsdb-index-template) or [@custom component template](#logsdb-component-template):
- **New data streams:** Create a new template, specifying `logsdb` for the index mode. New data streams matching the template's index pattern use logsdb mode automatically.
- **Existing data streams:** Update the templates the data stream references. Logsdb mode will take effect on the next [rollover](/elastic/docs-content/pull/8263/manage-data/data-store/data-streams#data-streams-rollover). For integrations, refer to [Enable logsdb for integrations](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8263/manage-data/data-store/data-streams/logs-data-stream-integrations).


### Set logsdb mode in an index template

<tab-set>
  <tab-item title="Kibana">
    To create or edit an index template in Kibana:
    1. Go to **Index Management** using the navigation menu or the [global search field](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8263/explore-analyze/find-and-organize/find-apps-and-objects).
    2. On the **Index Templates** tab, click **Create template** to create a new template, or click the name of an existing template to edit it.
       <tip>
       If you have existing templates labeled **Managed**, refer to [Enable logsdb for integrations](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8263/manage-data/data-store/data-streams/logs-data-stream-integrations) or [Default logs index template](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8263/solutions/observability/logs/logs-index-template-defaults).
       </tip>
    3. Complete the steps in the wizard. In the **Logistics** step:
       - <applies-to>Elastic Cloud Serverless: Generally available</applies-to> Click the **Set index mode** toggle to show the **Index mode** field.
    - Select **LogsDB** as the **Index mode**.
  </tab-item>

  <tab-item title="API">
    To create or update an index template:
    - In an Elastic Stack deployment, use the [create index template](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-put-index-template) API.
    - In Elastic Cloud Serverless, use the [create index template](https://www.elastic.co/docs/api/doc/elasticsearch-serverless/operation/operation-indices-put-index-template) API.
    First retrieve the current configuration, if any, so you can preserve existing settings. The PUT request **overwrites** any existing template.
    ```json
    ```
    Set `index.mode` to `logsdb` in the template request:
    ```json

    {
      "index_patterns": ["my-data-*"],
      "data_stream": { },
      "template": {
         "settings": {
            "index.mode": "logsdb"
         }
      },
      "priority": 200
    }
    ```
  </tab-item>
</tab-set>


### Set logsdb mode for integrations

To enable logsdb mode for integration data streams, create or update a `@custom` component template for each logs dataset. For details, refer to [Enable logsdb for integrations](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8263/manage-data/data-store/data-streams/logs-data-stream-integrations).

## Next steps

- [Configure a logs data stream](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8263/manage-data/data-store/data-streams/logs-data-stream-configure)
- [Review mappings and sorting](/elastic/docs-content/pull/8263/manage-data/data-store/data-streams/logs-data-stream-configure#logsdb-host-name)
- [Use a data stream](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8263/manage-data/data-store/data-streams/use-data-stream)
- [Enable logsdb for integrations](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8263/manage-data/data-store/data-streams/logs-data-stream-integrations)
- [Advanced data source configuration for Elastic Security rules](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8263/solutions/security/detect-and-alert/advanced-data-source-configuration)