# Estimation for ELK setup? **URL:** \ **Category:** Elasticsearch\ **Created:** [May 23, 2018, 2:41am UTC](https://discuss.elastic.co/t/estimation-for-elk-setup/132916 "2018-05-23T02:41:49Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [May 23, 2018, 2:41am UTC](https://discuss.elastic.co/t/estimation-for-elk-setup/132916/1 "2018-05-23T02:41:49Z")
Hello, can some expert help me to estimate in man/days, to setup ELK stack in one evnironment? Data on-boarding of system matrix from 40 clients. Writing Groke patterns for 5 different patterns Configuration of Logstash-Kibana-ES Installation of x-pack Creating visualizations: Host overview, System-Overview using Guage/bar charts/Timeseries using Visual builder and some ad-hoc tasks and unforeseen issues How much time I need to do this all? I want expert opinion considering some practical issues they faced in their experience. Please comment. br, Sunil. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 23, 2018, 4:07am UTC](https://discuss.elastic.co/t/estimation-for-elk-setup/132916/2 "2018-05-23T04:07:06Z")
Is this for a customer of yours? ---
**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Post date:** [May 23, 2018, 5:24am UTC](https://discuss.elastic.co/t/estimation-for-elk-setup/132916/3 "2018-05-23T05:24:55Z")
This is almost impossible to answer as it depends a lot on how truly "expert" the person doing the work is, and how much of the solution the expert has "pre-developed". For example we recently deployed a five node ES cluster, with a 3 node Kafka cluster (incl. 3 node Zookeeper) on the ingest side, and a single node monitoring instance, tapped into a datafeed from Azure IoT Hub and built the first dashboards... all done by one person in a single day. To do so requires a lot of experience with the platforms, and a lot of preconfigured bits to start from. The same goes for handling data sources. Take something as supposedly simple as syslog. Our parsing of the just the header portion of a syslog message can handle all the most common structures you will see. But it also handles 30+ "wierd ways vendors abuse syslog". So in just a few minutes we can setup syslog handling that will reliably handle a wide variety of messages thrown at it, where others could spend a day or two just figuring out all the variations of timestamp that they will have to deal with. > In case you are wondering, this is the regex for all of the variations of timestamp we have seen... ```auto (?:(?:\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\b +(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?!<[0-9])(?:2[0123]|[01]?[0-9]):(?:[0-5][0-9])(?::(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?))(?![0-9])( +(?>\d\d){1,2})?|\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\b +(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) (?>\d\d){1,2} (?!<[0-9])(?:2[0123]|[01]?[0-9]):(?:[0-5][0-9])(?::(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?))(?![0-9]))|(?>\d\d){1,2}-(?:0?[1-9]|1[0-2])-(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])[T](?:2[0123]|[01]?[0-9]):?(?:[0-5][0-9])(?::?(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?))?(?:Z|[+-](?:2[0123]|[01]?[0-9])(?::?(?:[0-5][0-9])))?)\s+ ``` So it will depend a lot on the scale required, how truly expert the person doing the work is, and how much of the solution might pre-exist. ---
**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Post date:** [May 23, 2018, 6:19am UTC](https://discuss.elastic.co/t/estimation-for-elk-setup/132916/4 "2018-05-23T06:19:21Z")
This is required for me. I want to give estimation and later need to justify to superiors who don't know the stack. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 20, 2018, 6:19am UTC](https://discuss.elastic.co/t/estimation-for-elk-setup/132916/5 "2018-06-20T06:19:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.