The subject of my internship is over 3 years to put in place an architecture to log , analyze, and visualize the events of this company.
So I set up a POC , which I harvest the logs of a dozen servers. I do not have a lot of financial resources to implement this solution. So I installed the ELK stack of 3 servers.
There's a number of other threads on this and the answer is the same.
You need to know how much data you are dealing with.
Then run benchmarks on a single server to see how much data it can cope with.
And extrapolate from that so you know how many nodes you may need for that given data set.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.