Elasticsearch cluster config requirement for graylog setup


(Nilesh Date) #1

Hi ,

I will be configuring graylog cluster in my oragization which will have elasticsearch cluster in it.
I would like to know the configuration required for my elasticsearch cluster . I will be having 3 nodes in ES cluster.
Below is my requirement -

Assumptions
11k messages/second (peak)
150 bytes per message (based on average message size for syslog messages)
30 days retention (4.5TB for raw data and 9TB total including replica indices)
Data redundancy (Clustered ES with replicas)
6-12 concurrent users actively executing search queries
4-8 streams & extractors
Full HA support for Graylog application nodes and ES
Assumes no significant growth in data volume over time

Please assist


(Mark Walkom) #2

What sort of things are you after exactly?

Have you read this part of the Definitive Guide?


(Nilesh Date) #3

I want to know required configuration for each server in elasticsearch cluster since it will part of my graylog setup in production environment.

yes, I have read the guide. After reading I come up with below config details.

16 Cores (Intel 64-bit CPUs)
48GB RAM
4TB RAID 0 (SSD preferred or 15K RPM SATA)


(system) #4