# Elasticsearch cluster config requirement for graylog setup

**URL:** <https://discuss.elastic.co/t/elasticsearch-cluster-config-requirement-for-graylog-setup/23833>\
**Category:** Elasticsearch\
**Created:** [June 17, 2015, 12:06pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-config-requirement-for-graylog-setup/23833 "2015-06-17T12:06:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nilesh\_Date](https://avatars.discourse-cdn.com/v4/letter/n/a9a28c/32.png) [@Nilesh\_Date](https://discuss.elastic.co/u/Nilesh_Date)\
**Post date:** [June 17, 2015, 12:06pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-config-requirement-for-graylog-setup/23833/1 "2015-06-17T12:06:49Z")

</div>

Hi ,

I will be configuring graylog cluster in my oragization which will have elasticsearch cluster in it.  
I would like to know the configuration required for my elasticsearch cluster . I will be having 3 nodes in ES cluster.  
Below is my requirement -

Assumptions  
11k messages/second (peak)  
150 bytes per message (based on average message size for syslog messages)  
30 days retention (4.5TB for raw data and 9TB total including replica indices)  
Data redundancy (Clustered ES with replicas)  
6-12 concurrent users actively executing search queries  
4-8 streams & extractors  
Full HA support for Graylog application nodes and ES  
Assumes no significant growth in data volume over time

Please assist

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 18, 2015, 2:50am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-config-requirement-for-graylog-setup/23833/2 "2015-06-18T02:50:23Z")

</div>

What sort of things are you after exactly?

Have you read [this part](https://www.elastic.co/guide/en/elasticsearch/guide/current/deploy.html) of the Definitive Guide?

---

<div class="post-metadata">

**Author:** ![Nilesh\_Date](https://avatars.discourse-cdn.com/v4/letter/n/a9a28c/32.png) [@Nilesh\_Date](https://discuss.elastic.co/u/Nilesh_Date)\
**Post date:** [June 18, 2015, 12:36pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-config-requirement-for-graylog-setup/23833/3 "2015-06-18T12:36:52Z")

</div>

I want to know required configuration for each server in elasticsearch cluster since it will part of my graylog setup in production environment.

yes, I have read the guide. After reading I come up with below config details.

16 Cores (Intel 64-bit CPUs)  
48GB RAM  
4TB RAID 0 (SSD preferred or 15K RPM SATA)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:06am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-config-requirement-for-graylog-setup/23833/4 "2017-07-06T00:06:44Z")

</div>


