# Hardware configuration - tips

**URL:** https://discuss.elastic.co/t/hardware-configuration-tips/33255
**Category:** Elasticsearch
**Created:** [October 29, 2015, 2:22pm UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255 "2015-10-29T14:22:24Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![Arvid\_de\_Jong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arvid_de_jong/32/5566_2.png) [@Arvid\_de\_Jong](https://discuss.elastic.co/u/Arvid_de_Jong)
#### Post date: [October 29, 2015, 2:22pm UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255/1 "2015-10-29T14:22:24Z")

</div>

Hello all!

I'm new to this forum, and rather new to Elasticsearch. I've been playing around a little bit with the ELK-stack on virtual machines. Now however, I would like to know what it takes to get it in a production environment (hardware wise).

I receive around 300 MB of log files with peaks of 1 GB a day. From around 250 servers. Any suggestions about memory, how many cores, nodes and maybe other tips? And why I should use that amount of memory or cores etc.

Any tips would be appreciated!

With kind regards,

Arvid de Jong

---

<div class="post-metadata">

### Author: ![niraj\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_kumar/32/4130_2.png) [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)
#### Post date: [October 29, 2015, 5:32pm UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255/2 "2015-10-29T17:32:33Z")

</div>

Hi @Arvid_de_Jong,

The amount of data you have seems to be a small one with decent peaks. What i would recommend you is, go for a cluster system with 3 nodes for ES , 2 for Logstash and 2 for web tiers. The idea behind web tiers is to protect your ES behind a reverse proxy and same for 3 node ES cluster is to have a master-slave replica. For the hardware wise use the following:

1. 2 CPU , 8 GB RAM, 500 GB ---\> For ES
2. 1 CPU , 2 GB RAM 100 GB -----\> For Web tier
3. 2 CPU, 4 GB RAM 100 GB -------\> For Logstash

I hope i answered your need. Let us know if you want more info, on it.

Regards  
Niraj

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 30, 2015, 6:11am UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255/3 "2015-10-30T06:11:23Z")

</div>

LS doesn't need much disk space, but it likes CPU.  
Dunno why you'd want 100GB for a web front end either really.

---

<div class="post-metadata">

### Author: ![Arvid\_de\_Jong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arvid_de_jong/32/5566_2.png) [@Arvid\_de\_Jong](https://discuss.elastic.co/u/Arvid_de_Jong)
#### Post date: [November 2, 2015, 7:55am UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255/4 "2015-11-02T07:55:53Z")

</div>

Hi Niraj\_Kumar!

First of all, thanks allot for your help. Although i have another question, why do you think I should use 8 GB instead of 16, 32 or like Elasticsearch recomends, 64 GB of memory?

Thanks in advance!

Greetings,

Arvid de Jong

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 2, 2015, 8:16am UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255/5 "2015-11-02T08:16:22Z")

</div>

We don't recommend, the only recommendation we make is 30.5GB or less for heap.

Otherwise it's up to you!

---

<div class="post-metadata">

### Author: ![luuk](https://avatars.discourse-cdn.com/v4/letter/l/8e7dd6/32.png) [@luuk](https://discuss.elastic.co/u/luuk)
#### Post date: [November 2, 2015, 8:59am UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255/6 "2015-11-02T08:59:43Z")

</div>

hey!

Im running a similar environment (more or less),  
@niraj_kumar would you recommend the same if availability is not an issue?

Regards  
Luuk

---

<div class="post-metadata">

### Author: ![niraj\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_kumar/32/4130_2.png) [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)
#### Post date: [November 5, 2015, 6:07am UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255/7 "2015-11-05T06:07:40Z")

</div>

@Arvid_de_Jong The reason i recommended the memory to 8GB was due to amount of data you receive. Obviously there is no harm is using additional memory, but to make it cost effective i recommend that. If you are in a cloud environment like AWS you can increase the memory and CPU's on fly. You can always give it a shot to a lesser memory and experience the latency and then increase it there after. Hope i was clear.

---

<div class="post-metadata">

### Author: ![niraj\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_kumar/32/4130_2.png) [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)
#### Post date: [November 5, 2015, 6:11am UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255/8 "2015-11-05T06:11:16Z")

</div>

The reason i suggested 100GB is for web tier is because of the massive log generation by apache/nginx and in case you want to store previous logs considering it as a production server. It can definitely be down sized and i agree to it. I made it this way because that would remove any disk space usage.

---

<div class="post-metadata">

### Author: ![niraj\_kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_kumar/32/4130_2.png) [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)
#### Post date: [November 5, 2015, 6:20am UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255/9 "2015-11-05T06:20:45Z")

</div>

@luuk Kind of i recommend the same but we can downsize the logstash to one and reducing a node from ES too. But anyways it depends on what infrastructure you have and what you are trying to achieve with the ELK stack.

---

<div class="post-metadata">

### Author: ![Arvid\_de\_Jong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arvid_de_jong/32/5566_2.png) [@Arvid\_de\_Jong](https://discuss.elastic.co/u/Arvid_de_Jong)
#### Post date: [November 9, 2015, 2:34pm UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255/10 "2015-11-09T14:34:30Z")

</div>

Thanks allot! I will try this setup and will work from there! 😄

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 11:39pm UTC](https://discuss.elastic.co/t/hardware-configuration-tips/33255/11 "2017-07-05T23:39:46Z")

</div>


