Hardware requirements for production cluster

[stevesimpson]

Thank you for your detail reply @DavidTurner

Do you need the "warm" tier at all? Do you need three data nodes or would two be enough?

The Hot/Warm architecture was already in place when I took over this project, however based on your recommendations I will look at this again. It does certainly appear to be excessive on reflection. I'm considering a three node setup for the following two reasons:

1. I'm thinking about using a RAID 0 array for Elasticsearch data configured with a replication factor of 2. I've based this on somewhat old documentation but the logic still seems valid: Hardware | Elasticsearch: The Definitive Guide [2.x] | Elastic
2. We have an "N+2" philosophy for all production kit, unless there is a good reason not to do this I'm inclined to keep this the same. We could absolutely start with two nodes however and then scale up, my concern then would be not wanting to run a RAID 0 array.

@DavidTurner

You focussed on ingest load rather than search. Does this mean you expect the search load to be relatively light? If so, again, 3x coordinating nodes sounds excessive. Perhaps you can just search on the data nodes directly (via your load balancer)? Again, only benchmarking with a realistic workload can say for sure.

I think again the logic of N+2 comes into play with regard to 3 nodes. I expect the search load to be light however the types of search will usually involves massive amounts of results of large date ranges. Think along the lines of number of times an IP has hit our servers over a 3 month period. (We average ~600 requests per second through our loadbalancers).

@DavidTurner

It sounds like you can put a load balancer between your Kibana nodes and the Elasticsearch nodes, although the recommended architecture is to point each Kibana at a single node.

I did consider this approach however I thought for a relatively low spend we would get the added benefit of "smart loadbalancing" (Scatter/Gather benefits) with coordinator nodes which we wouldn't get with HAProxy.

@DavidTurner

They won't need much disk but will use a decent amount of RAM if you are going to hit them hard with lots of heavy aggregations or other expensive searches.

Thank you for this, I'll keep this in mind.

Once again, appreciate your input