# Best practice for implement ELK

**URL:** <https://discuss.elastic.co/t/best-practice-for-implement-elk/137967>\
**Category:** Elasticsearch\
**Created:** [June 29, 2018, 1:10pm UTC](https://discuss.elastic.co/t/best-practice-for-implement-elk/137967 "2018-06-29T13:10:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Luke\_Devon](https://avatars.discourse-cdn.com/v4/letter/l/90ced4/32.png) [@Luke\_Devon](https://discuss.elastic.co/u/Luke_Devon)\
**Post date:** [June 29, 2018, 1:10pm UTC](https://discuss.elastic.co/t/best-practice-for-implement-elk/137967/1 "2018-06-29T13:10:12Z")

</div>

Hi,

For all "elasticsearch" experts out there .......!!!!

Could you please tell me what is the best practice to implement ELK in a big data/logs analyzing environment?

Currently, I have installed and tested all 3 ELK component in a single server. But I have a doubt in a long run, I might face some performance issue. Please advice.

Thank you  
Luke.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [June 29, 2018, 7:16pm UTC](https://discuss.elastic.co/t/best-practice-for-implement-elk/137967/2 "2018-06-29T19:16:32Z")

</div>

May I suggest you look at the following resources about sizing and architecture:

[https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing](https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing)

> **[How many shards should I have in my Elasticsearch cluster?
	  	 | Elastic](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)**
>
> Elasticsearch is a very versatile platform, that supports a variety of use cases, and provides great flexibility around data organisation and replication strategies. This flexibility can however somet...

> **[NetSecureDay: Managing your Black Friday Logs](https://speakerdeck.com/elastic/netsecureday-managing-your-black-friday-logs)**
>
> Surveiller une application complexe n’est pas une tâche aisée, mais avec les bons outils, ce n’est pas si sorcier. Néanmoins, des périodes fortes telles que les opérations de type « Black Friday » (Vendredi noir) ou période de Noël peuvent pousser...

Specifically this last video could give you some ideas.

---

<div class="post-metadata">

**Author:** ![Luke\_Devon](https://avatars.discourse-cdn.com/v4/letter/l/90ced4/32.png) [@Luke\_Devon](https://discuss.elastic.co/u/Luke_Devon)\
**Post date:** [June 30, 2018, 1:10pm UTC](https://discuss.elastic.co/t/best-practice-for-implement-elk/137967/3 "2018-06-30T13:10:44Z")

</div>

Thank you David, that video helps me a lot.

---

<div class="post-metadata">

**Author:** ![richl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richl/32/28946_2.png) [@richl](https://discuss.elastic.co/u/richl)\
**Post date:** [June 30, 2018, 6:51pm UTC](https://discuss.elastic.co/t/best-practice-for-implement-elk/137967/4 "2018-06-30T18:51:32Z")

</div>

Hi check out this use case video [https://www.elastic.co/elasticon/tour/2017/chicago/elastic-at-paylocity-analyzing-800-gb-a-day](https://www.elastic.co/elasticon/tour/2017/chicago/elastic-at-paylocity-analyzing-800-gb-a-day) it really got my thought process going.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 28, 2018, 6:51pm UTC](https://discuss.elastic.co/t/best-practice-for-implement-elk/137967/5 "2018-07-28T18:51:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.