3 nodes configuration for efficiency

Elastic Stack Elasticsearch
1

Hello,

I am fairly new to ELK stack. I have three servers and they have same processor and disk size, they only differ in size of RAM

server 1: 16 GB RAM
server 2: 8 GB RAM
server 3: 8 GB RAM

I read about various nodes in an articles and decide following architecture based on very little information.

server 1: elasticsearch (as it is taking more memory), data node, eligible master node, logstash, ingest

server 2: data node, eligible master node, logstash, ingest

sever 3: dedicated master node, kibana

I want to configure Kibana, logstash, elasticsearch on these sever so that it will give a result of query in minimum time. What is the best trade off or architecture suitable for this kind of specification and does the mentioned design make sense.

2

I'd put elasticsearch alone to give it the maximum resources as possible.

Colocation of Kibana will only reduce the latency between elasticsearch and Kibana but I doubt that network is an issue those days or you have a very bad network you should fix :slight_smile:

3

Thanks for your reply. Does it make sense if I configure like this

server 1: elasticsearch (as it is taking more memory), ingest

server 2: data node, eligible master node, logstash, ingest

sever 3: dedicated master node, kibana

4

Yes. But I'd keep 1st node as master eligible to avoid split brain issues

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.