# Elasticsearch shard size

**URL:** <https://discuss.elastic.co/t/elasticsearch-shard-size/120450>\
**Category:** Elasticsearch\
**Created:** [February 19, 2018, 12:35pm UTC](https://discuss.elastic.co/t/elasticsearch-shard-size/120450 "2018-02-19T12:35:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kr0gh](https://avatars.discourse-cdn.com/v4/letter/k/90db22/32.png) [@kr0gh](https://discuss.elastic.co/u/kr0gh)\
**Post date:** [February 19, 2018, 12:35pm UTC](https://discuss.elastic.co/t/elasticsearch-shard-size/120450/1 "2018-02-19T12:35:41Z")

</div>

Hi Elasticsearch community,

I am tasked with implementing the elastic stack for the company i work at. I am not sure how many shards i should allocate to each node. The solution is to be used for log management.

We will be having a total of 3 elasticsearch nodes to begin with, and the log intake will grow over time. My company are providing hosting for customers, and they will offer the log management solution as a managed product. This also means that the design needs to take into consideration that the data intake will grow over time, as customers joins in on the solution.

What do you think would be the most clever approach here? How many shards should I allocate?

I will create a new index every day of the month, and keep the logs searchable for a month. After that I think we will move the data to an external location. The customers will each get a unique type identifier.

Customers will be medium sized companies and up to 15.000 of them, as the current highest possible number. I am not sure what this potentially could add up to in regards to data amount. But I guess we are talking TB's pr. day at a late stage.

Any help or insight would be much appreciated.

/Anders

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 19, 2018, 1:05pm UTC](https://discuss.elastic.co/t/elasticsearch-shard-size/120450/2 "2018-02-19T13:05:07Z")

</div>

May I suggest you look at the following resources about sizing:

[https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing](https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing)

> **[How many shards should I have in my Elasticsearch cluster?
	  	 | Elastic](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)**
>
> Elasticsearch is a very versatile platform, that supports a variety of use cases, and provides great flexibility around data organisation and replication strategies. This flexibility can however somet...

> **[NetSecureDay: Managing your Black Friday Logs](https://speakerdeck.com/elastic/netsecureday-managing-your-black-friday-logs)**
>
> Surveiller une application complexe n’est pas une tâche aisée, mais avec les bons outils, ce n’est pas si sorcier. Néanmoins, des périodes fortes telles que les opérations de type « Black Friday » (Vendredi noir) ou période de Noël peuvent pousser...

---

<div class="post-metadata">

**Author:** ![kr0gh](https://avatars.discourse-cdn.com/v4/letter/k/90db22/32.png) [@kr0gh](https://discuss.elastic.co/u/kr0gh)\
**Post date:** [February 22, 2018, 2:24pm UTC](https://discuss.elastic.co/t/elasticsearch-shard-size/120450/3 "2018-02-22T14:24:05Z")

</div>

Thank you, that helped 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2018, 2:24pm UTC](https://discuss.elastic.co/t/elasticsearch-shard-size/120450/4 "2018-03-22T14:24:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.