I will be configuring graylog cluster in my oragization which will have elasticsearch cluster in it.
I would like to know the configuration required for my elasticsearch cluster . I will be having 3 nodes in ES cluster.
Below is my requirement -
11k messages/second (peak)
150 bytes per message (based on average message size for syslog messages)
30 days retention (4.5TB for raw data and 9TB total including replica indices)
Data redundancy (Clustered ES with replicas)
6-12 concurrent users actively executing search queries
4-8 streams & extractors
Full HA support for Graylog application nodes and ES
Assumes no significant growth in data volume over time