# First Claster for log collection

**URL:** <https://discuss.elastic.co/t/first-claster-for-log-collection/267765>\
**Category:** Elasticsearch\
**Created:** [March 19, 2021, 8:18am UTC](https://discuss.elastic.co/t/first-claster-for-log-collection/267765 "2021-03-19T08:18:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![zenekas1978](https://avatars.discourse-cdn.com/v4/letter/z/58f4c7/32.png) [@zenekas1978](https://discuss.elastic.co/u/zenekas1978)\
**Post date:** [March 19, 2021, 8:18am UTC](https://discuss.elastic.co/t/first-claster-for-log-collection/267765/1 "2021-03-19T08:18:08Z")

</div>

Hi All,

I would like to build my first ELK cluster in Azure in order to collect and analyze logs from VM's and firewalls. I used ELK Azure template and I created 3 masters, 1 data, Kibana and Logstash nodes.

I would like to monitor ~100 VM's and ~20 network devices.  
I plan to keep logs 30 days.  
Most of VM uses Windows Server so I plan to use winlogbeat to send logs to ELK.

How many nodes I should use for cluster?  
It's very hard to calculate storage size I will need.  
Do you think the above scenario is enough? or I should use a different schema?  
I used azure Ds1v2 for all nodes. (Data + 512 GB drive ssd)

Thanks for help and advice.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 22, 2021, 1:07am UTC](https://discuss.elastic.co/t/first-claster-for-log-collection/267765/2 "2021-03-22T01:07:25Z")

</div>

Welcome to our community! 😃

I think you will probably run out of space with that many VMs. You might want to setup your cluster, ingest some data and then see what it can hold and extrapolate from there.

---

<div class="post-metadata">

**Author:** ![zenekas1978](https://avatars.discourse-cdn.com/v4/letter/z/58f4c7/32.png) [@zenekas1978](https://discuss.elastic.co/u/zenekas1978)\
**Post date:** [March 22, 2021, 8:27am UTC](https://discuss.elastic.co/t/first-claster-for-log-collection/267765/3 "2021-03-22T08:27:47Z")

</div>

Hi Mark,

Do you have any proposition for me?  
How my cluster should look ? Do i need 3 masters and 1 data node or i should use different schema?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 22, 2021, 9:23am UTC](https://discuss.elastic.co/t/first-claster-for-log-collection/267765/4 "2021-03-22T09:23:08Z")

</div>

The best cluster configuration to start with is generally 3 data nodes that also are master eligible. Once the cluster grows you can start exploring dedicated node types.

---

<div class="post-metadata">

**Author:** ![zenekas1978](https://avatars.discourse-cdn.com/v4/letter/z/58f4c7/32.png) [@zenekas1978](https://discuss.elastic.co/u/zenekas1978)\
**Post date:** [March 22, 2021, 12:02pm UTC](https://discuss.elastic.co/t/first-claster-for-log-collection/267765/5 "2021-03-22T12:02:48Z")

</div>

Thanks Christinan for the advice. I will try to customize Azure ELK template so I will be able to setup 3 nodes with master/data type + Kibana + Logstash. I connected one server during the last 5 days and it used 980 MB from my space.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2021, 12:03pm UTC](https://discuss.elastic.co/t/first-claster-for-log-collection/267765/6 "2021-04-19T12:03:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.