In rare cases the indexes can use more space than commonly expected. These scenarios are:
- A high amount of log records are received with very little information per log record. E.g. firewall-only logs on DNS traffic
- The log records have a high cardinality in sources and destinations