Hardware recommendation for fb + Logstash


I am mounting a server to run Filebeat + Logstahs which will send the output info to our Elastic Cloud Service. Currently, we are daily receiving around 500-600mb of logs and the processing they would go through is:
-Filebeat: multiline
-Logstash : simple grok patterns, a json transformation, and a couple of mutates. Quite simple in the end, we get around 30 fields.

I am thinking about this configuration:

Ubuntu Server 16.04 LTS con Plesk Onyx (64 bit)
Intel® Xeon® E3-1230 v6
4 Cores (HT) x 3,5 GHz (3,9 GHz Turbo Boost)
SSD 480 GB(2 x 480 GB)

Would it be enough to process the 600mb daily and send them to the cloud? Bandwidth is not an issue.

Thanks in advance!

The number of events to process is more interesting than their volume, but the suggested configuration is most likely way more than what you need. I have a two-core server with 4 GB RAM with two Logstash instances that together average 600 events/s and 15% CPU.

Danke @magnusbaeck , I've always have this tendency to aim to high (just in case) for this type of things. I'll let you know how it goes!

Have a nice day

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.