Elastic Search Node Configs

Elastic Stack Elasticsearch
1

I have seen people using multiple nodes on the same physical/virtual machine, I wanted to ask if there is an advantage to this. Logically, the disk space will be used for 2 copies also if the disk (or the RAID array dies) your data is toast, and your storage will be halved, but is there a significant advantage to having this config? Do the read/writes perform significantly better?

I have a cluster environment on 2 physical machines that I an trying to setup, what I am essentially looking for is fast writes and fast reads through Kibana searches and dashboards. Whats the optimal config on this?

I have 2 machines of 8C/64GB/4.8TB SSD machine which is dedicated to ELK. We also have about 3 billion total transactions that around 30 to 50 users can be querying.

2

People sometimes run multiple nodes on a single machine if it has a lot of RAM (remembering that Elasticsearch should have a maximum heap size of no more than ~31GB, ideally less) or if they want to attach SSDs and spinning disks to the same machine and control which shards are allocated to each storage class. It involves more admin, and a little more performance overhead than a single node, so it's best to avoid this unless your benchmarks show it to be worth it.

3

Right....so if I want fast searches and disk writes along with fast load times on dashboards, what is the ideal config.

4

I'd guess one node per machine, but it very much depends on your use case. The only way to be sure is to measure it.

5

What method would you recommend for measuring? Anything specific or just standard linux commands/metric beat system plugin?

6

Rally is the standard tool for benchmarking Elasticsearch clusters. I'm not an expert on its use, however, so if you have more detailed questions then I recommend opening another thread.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.