# Elasticsearch cluster design

**URL:** <https://discuss.elastic.co/t/elasticsearch-cluster-design/142300>\
**Category:** Elasticsearch\
**Created:** [July 31, 2018, 7:51am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-design/142300 "2018-07-31T07:51:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![peterch](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@peterch](https://discuss.elastic.co/u/peterch)\
**Post date:** [July 31, 2018, 7:51am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-design/142300/1 "2018-07-31T07:51:46Z")

</div>

Hi All,

I'm new on elk stack and planning the design of elasticsearch cluster which needs advice. I have around 9 to 10 million log every day. The log retention is 6 months, 1 year would be the best. I have following question of the cluster design

1. How much nodes should have? For now, i can have 2 to 3 tb to store log. I plan to have 2 to 3 nodes. 1 node is master and the others are data nodes. The availability of master node down is not my main concern, the cpu and memory usage is the main concern.

2. Do I need to decrease the amount of Shards and how much would be better in this situation?

3. If have more than 1 data node, Kibana should point to which data node.

4. Is it good to place kibana and elasticsearch master into the same node or separate is better.

Thanks

Best Regards,  
Peter Chow

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [July 31, 2018, 9:13am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-design/142300/2 "2018-07-31T09:13:50Z")

</div>

May I suggest you look at the following resources about sizing:

[https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing](https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing)

> **[How many shards should I have in my Elasticsearch cluster?
	  	 | Elastic](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)**
>
> Elasticsearch is a very versatile platform, that supports a variety of use cases, and provides great flexibility around data organisation and replication strategies. This flexibility can however somet...

> **[NetSecureDay: Managing your Black Friday Logs](https://speakerdeck.com/elastic/netsecureday-managing-your-black-friday-logs)**
>
> Surveiller une application complexe n’est pas une tâche aisée, mais avec les bons outils, ce n’est pas si sorcier. Néanmoins, des périodes fortes telles que les opérations de type « Black Friday » (Vendredi noir) ou période de Noël peuvent pousser...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2018, 9:13am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-design/142300/3 "2018-08-28T09:13:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.