# Elasticsearch sizing: Number of nodes, RAM needed
**URL:** https://discuss.elastic.co/t/elasticsearch-sizing-number-of-nodes-ram-needed/177186
**Category:** Elasticsearch
**Created:** [April 17, 2019, 4:51am UTC](https://discuss.elastic.co/t/elasticsearch-sizing-number-of-nodes-ram-needed/177186 "2019-04-17T04:51:22Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@thangld](https://discuss.elastic.co/u/thangld)
#### Post date: [April 17, 2019, 4:51am UTC](https://discuss.elastic.co/t/elasticsearch-sizing-number-of-nodes-ram-needed/177186/1 "2019-04-17T04:51:22Z")
I am trying to build an ES cluster to handle storing and searching event logs from security devices with following requirements: 25000 EPS, 1000 bytes/event, using hot/warm architecture with 4 days of hot and 90 days of warm. My question is how much ES nodes do I need? And how much RAM shoud I use? Thanks.
| Variable | Description | Calculation | Value | Unit |
| --- | --- | --- | --- | --- |
| EPS | Events per second | Estimate | 25000 | Events |
| AES | Average event size | Estimate | 1000 | Bytes |
| DUPD | Disk used per day | AESxEPSx60x60x24/1073741824 | 2011.656761 | GB |
| miSPD | Min Shards per day | DUPD/50 | 40.23313522 | Shards |
| HD | Hot days | Estimate | 4 | Days |
| WD | Warm days | Estimate | 90 | Days |
| xHD | Expected data on hot days (for indexing, searching, forge merging) | DUPD\*HD/1024 | 7.858034223 | TB |
| xWD | Expected data on warm days (read only indices for searching and creating replicas) | DUPD\*WD | 176.80577 | TB |
| miHD | Minimum disk size for hot days | xHD\*1.4 | 11.00124791 | TB |
| miWD | Minimum disk size for warm days | xWD\*1.4 | 247.528078 | TB |
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [April 17, 2019, 5:27am UTC](https://discuss.elastic.co/t/elasticsearch-sizing-number-of-nodes-ram-needed/177186/2 "2019-04-17T05:27:28Z")
This will depend on your data, hardware and query requirements. I would recommend looking at the following resources:
> **[Sizing Hot-Warm Architectures for Logging and Metrics in the Elasticsearch...](https://www.elastic.co/blog/sizing-hot-warm-architectures-for-logging-and-metrics-in-the-elasticsearch-service-on-elastic-cloud)**
>
> Want to learn more about the differences between the Amazon Elasticsearch Service and our official Elasticsearch Service? Visit our AWS Elasticsearch comparison page. These are exciting times! Elastic...
> **[How many shards should I have in my Elasticsearch cluster?
| Elastic](https://www.elastic.co/blog/how-many-shards-should-i-have-in-my-elasticsearch-cluster)**
>
> Elasticsearch is a very versatile platform, that supports a variety of use cases, and provides great flexibility around data organisation and replication strategies. This flexibility can however somet...
[https://www.elastic.co/webinars/using-rally-to-get-your-elasticsearch-cluster-size-right](https://www.elastic.co/webinars/using-rally-to-get-your-elasticsearch-cluster-size-right)
[https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing](https://www.elastic.co/elasticon/conf/2016/sf/quantitative-cluster-sizing)
[https://www.elastic.co/webinars/optimizing-storage-efficiency-in-elasticsearch](https://www.elastic.co/webinars/optimizing-storage-efficiency-in-elasticsearch)
[https://www.elastic.co/elasticon/conf/2018/sf/the-seven-deadly-sins-of-elasticsearch-benchmarking](https://www.elastic.co/elasticon/conf/2018/sf/the-seven-deadly-sins-of-elasticsearch-benchmarking)
---
### Author:  [@thangld](https://discuss.elastic.co/u/thangld)
#### Post date: [April 17, 2019, 10:30am UTC](https://discuss.elastic.co/t/elasticsearch-sizing-number-of-nodes-ram-needed/177186/3 "2019-04-17T10:30:39Z")
Thank you sir.
Very useful articles!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 15, 2019, 10:30am UTC](https://discuss.elastic.co/t/elasticsearch-sizing-number-of-nodes-ram-needed/177186/4 "2019-05-15T10:30:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.