# Best way to view large centrlized syslog(CentOS) using ELK docker images **URL:** \ **Category:** Elasticsearch\ **Created:** [June 7, 2018, 2:18pm UTC](https://discuss.elastic.co/t/best-way-to-view-large-centrlized-syslog-centos-using-elk-docker-images/135015 "2018-06-07T14:18:34Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![netvmdb](https://avatars.discourse-cdn.com/v4/letter/n/b9e5f3/32.png) [@netvmdb](https://discuss.elastic.co/u/netvmdb)\ **Post date:** [June 7, 2018, 2:18pm UTC](https://discuss.elastic.co/t/best-way-to-view-large-centrlized-syslog-centos-using-elk-docker-images/135015/1 "2018-06-07T14:18:34Z")
Hello, This is my first post. I have 10GB/day centralized syslog from CentOS systems. Log files can be accessed from local or NFS mount. Need at least two fields(timestamp and host) to filter logs. Total users are less than five. 1. What kind of setup you would recommend? Minimum hardware requirement. Multiple ingest/data nodes? Will logstash be the bottleneck? How do I scale up if I have more log in the future. 2. Since I need to filter data using host and timestamp, I assume filebeat cannot be used. Do I have to use logstash? If so, is grok the only way to add timestamp and host fields? Thanks. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 7, 2018, 4:01pm UTC](https://discuss.elastic.co/t/best-way-to-view-large-centrlized-syslog-centos-using-elk-docker-images/135015/2 "2018-06-07T16:01:38Z")
May I suggest you look at the following resources about sizing: [https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing](https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing) > **[How many shards should I have in my Elasticsearch cluster? | Elastic](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)** > > Elasticsearch is a very versatile platform, that supports a variety of use cases, and provides great flexibility around data organisation and replication strategies. This flexibility can however somet... > **[NetSecureDay: Managing your Black Friday Logs](https://speakerdeck.com/elastic/netsecureday-managing-your-black-friday-logs)** > > Surveiller une application complexe n’est pas une tâche aisée, mais avec les bons outils, ce n’est pas si sorcier. Néanmoins, des périodes fortes telles que les opérations de type « Black Friday » (Vendredi noir) ou période de Noël peuvent pousser... ---
**Author:** ![netvmdb](https://avatars.discourse-cdn.com/v4/letter/n/b9e5f3/32.png) [@netvmdb](https://discuss.elastic.co/u/netvmdb)\ **Post date:** [June 19, 2018, 2:18pm UTC](https://discuss.elastic.co/t/best-way-to-view-large-centrlized-syslog-centos-using-elk-docker-images/135015/3 "2018-06-19T14:18:12Z")
Thank you for the links. Let's say I want to set shards size to 25GB and number of shards per GB to 20, but how do I define shards size and number of shards per GB? If I use default setting - 5 primary shards and 1 replica shard per index, for my time-based daily-indices of centralized logs, should I have 1.. 3 to 5 nodes with default settings(all have node.master/node.data/node.ingest set to true) 2.. 1 master node, two data nodes, two ingest nodes 3.. Other layout, like 1 co-node and 3 master-eligible nodes... Regards, ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 17, 2018, 2:18pm UTC](https://discuss.elastic.co/t/best-way-to-view-large-centrlized-syslog-centos-using-elk-docker-images/135015/4 "2018-07-17T14:18:16Z")
Closed on July 17, 2018, 2:18pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.