# Hardware recommendation for fb + Logstash

**URL:** <https://discuss.elastic.co/t/hardware-recommendation-for-fb-logstash/150555>\
**Category:** Logstash\
**Created:** [October 1, 2018, 10:58am UTC](https://discuss.elastic.co/t/hardware-recommendation-for-fb-logstash/150555 "2018-10-01T10:58:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ratman](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@ratman](https://discuss.elastic.co/u/ratman)\
**Post date:** [October 1, 2018, 10:58am UTC](https://discuss.elastic.co/t/hardware-recommendation-for-fb-logstash/150555/1 "2018-10-01T10:58:47Z")

</div>

Hello!

I am mounting a server to run Filebeat + Logstahs which will send the output info to our Elastic Cloud Service. Currently, we are daily receiving around 500-600mb of logs and the processing they would go through is:  
-Filebeat: multiline  
-Logstash : simple grok patterns, a json transformation, and a couple of mutates. Quite simple in the end, we get around 30 fields.

I am thinking about this configuration:

Ubuntu Server 16.04 LTS con Plesk Onyx (64 bit)  
Intel® Xeon® E3-1230 v6  
4 Cores (HT) x 3,5 GHz (3,9 GHz Turbo Boost)  
16 GB DDR4 ECC  
SSD 480 GB(2 x 480 GB)

Would it be enough to process the 600mb daily and send them to the cloud? Bandwidth is not an issue.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 3, 2018, 6:37pm UTC](https://discuss.elastic.co/t/hardware-recommendation-for-fb-logstash/150555/2 "2018-10-03T18:37:26Z")

</div>

The number of events to process is more interesting than their volume, but the suggested configuration is most likely way more than what you need. I have a two-core server with 4 GB RAM with two Logstash instances that together average 600 events/s and 15% CPU.

---

<div class="post-metadata">

**Author:** ![ratman](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@ratman](https://discuss.elastic.co/u/ratman)\
**Post date:** [October 4, 2018, 6:42am UTC](https://discuss.elastic.co/t/hardware-recommendation-for-fb-logstash/150555/3 "2018-10-04T06:42:48Z")

</div>

Danke @magnusbaeck , I've always have this tendency to aim to high (just in case) for this type of things. I'll let you know how it goes!

Have a nice day

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2018, 6:45am UTC](https://discuss.elastic.co/t/hardware-recommendation-for-fb-logstash/150555/4 "2018-11-01T06:45:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
