I'm new on elk stack and planning the design of elasticsearch cluster which needs advice. I have around 9 to 10 million log every day. The log retention is 6 months, 1 year would be the best. I have following question of the cluster design
How much nodes should have? For now, i can have 2 to 3 tb to store log. I plan to have 2 to 3 nodes. 1 node is master and the others are data nodes. The availability of master node down is not my main concern, the cpu and memory usage is the main concern.
Do I need to decrease the amount of Shards and how much would be better in this situation?
If have more than 1 data node, Kibana should point to which data node.
Is it good to place kibana and elasticsearch master into the same node or separate is better.