After investigating storage costs for the cloud trail integration, it was shown that we are storing some large fields multiple times.

cloudtrail.response_elements, cloudtrail.request_elements , cloudtrail.additional_eventdata fields.

We store them five times: _source, keyword, text, and then flattened, which stores them twice (keyed and unkeyed)

After discussion with @efd6, the recommendation is to add a configuration value to disable the flattened fields.