We're in the process of migrating platforms and we're looking for architectural guidance. We've been told by Elastic that Elasticsearch nodes should be using CGroups (56 core machines, multiple nodes per machine), but I'd like some clarity around Logstash and control groups.
We'll be running about 900 instances (systemd services) of logstash spread across 100 machines with 56 core / 768gb ram directly on RHEL7. We'll have approximately 3 data nodes per machine using 36 cores (12 each). Should we implement a control group to be shared among the remaining cores for logstash or should we just run them as general services using all available resources?
edit Looking for best practices