Hi, to gain index size I made the log format as below. I didn't use key value pair. 20121101095842|192.168.1.2|KRQQQShcnQdRK8pLKTXC|20138494756382|I|PLAY|this the detailed info|1 And in transforms.conf I defined the fields. DELIMS="|" FIELDS=time,sourceip,session_id,customer_id,channel,op_type,detail,result_code What if I made the log format like; time=20121101095842,sourceip=192.168.1.2,sessiın_id=KRQQQShcnQdRK8pLKTXC,customer_id=20138494756382,channel=I, op_type=PLAY, detail=this the detailed info|result_code=1 Is there any performance diffrence between these two? a big diffrence in speed? thanks, a. ... View more