ELK Architecture and requirements

For that load pretty much any 3 modern machines will do fine. As for requirements more is more :slight_smile:

RAM:
A machine with 64 GB of RAM is the ideal sweet spot, but 32 GB and 16 GB machines are also common. Less than 8 GB tends to be counterproductive...

CPUs:
Most Elasticsearch deployments tend to be rather light on CPU requirements. As such, the exact processor setup matters less than the other resources. You should choose a modern processor with multiple cores. Common clusters utilize two- to eight-core machines.

Disk:
If you can afford SSDs, they are by far superior to any spinning media. SSD-backed nodes see boosts in both query and indexing performance....

Even with 1 TB of disk per node you would have 3TB / 2 (if you use one replica per shard) for your indices. 1500GB (total storage) /0.5 GB (daily data) = 3000 days of retention :stuck_out_tongue:

1 Like