Hardware recommendation for fb + Logstash

Elastic Stack Logstash
1

Hello!

I am mounting a server to run Filebeat + Logstahs which will send the output info to our Elastic Cloud Service. Currently, we are daily receiving around 500-600mb of logs and the processing they would go through is:
-Filebeat: multiline
-Logstash : simple grok patterns, a json transformation, and a couple of mutates. Quite simple in the end, we get around 30 fields.

I am thinking about this configuration:

Ubuntu Server 16.04 LTS con Plesk Onyx (64 bit)
Intel® Xeon® E3-1230 v6
4 Cores (HT) x 3,5 GHz (3,9 GHz Turbo Boost)
16 GB DDR4 ECC
SSD 480 GB(2 x 480 GB)

Would it be enough to process the 600mb daily and send them to the cloud? Bandwidth is not an issue.

Thanks in advance!

2

The number of events to process is more interesting than their volume, but the suggested configuration is most likely way more than what you need. I have a two-core server with 4 GB RAM with two Logstash instances that together average 600 events/s and 15% CPU.

3

Danke @magnusbaeck , I've always have this tendency to aim to high (just in case) for this type of things. I'll let you know how it goes!

Have a nice day

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.