Thanks for your feedback Magnus, do you have any guidance on the spec for the logstash nodes?
It depends on the event rate and what you want Logstash to do with the events.
I'm looking to start with a VMs for logstash I'm guessing that's ok until I find that througput is such that they need dedicated disks or nics?
Logstash typically doesn't require much I/O and you'll saturate the CPUs long before the NICs.
is there a minimum RAM reqirement?
It does run in a JVM with a default max heap size of 1 or 2 GB so the very smallest machines will be too small.