# Logstash and Kibana for App Log files recommendations

**URL:** <https://discuss.elastic.co/t/logstash-and-kibana-for-app-log-files-recommendations/106769>\
**Category:** Logstash\
**Created:** [November 7, 2017, 11:27pm UTC](https://discuss.elastic.co/t/logstash-and-kibana-for-app-log-files-recommendations/106769 "2017-11-07T23:27:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![VIJAY\_JOHN\_BRITTO](https://avatars.discourse-cdn.com/v4/letter/v/9d8465/32.png) [@VIJAY\_JOHN\_BRITTO](https://discuss.elastic.co/u/VIJAY_JOHN_BRITTO)\
**Post date:** [November 7, 2017, 11:27pm UTC](https://discuss.elastic.co/t/logstash-and-kibana-for-app-log-files-recommendations/106769/1 "2017-11-07T23:27:30Z")

</div>

Hello All  
We are planning to implement Logstash with kibana for our application logs(log4 j - weblogic..).

We have about 10 applications running in 10 instances, we would have about 100 logs files. Total size would be about 100-150GB.

What would be the recommended server configurations? Do we need to have dedicated server for Elastic search and logstash?

Any help would be appreciated

Thanks  
Vijay

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 8, 2017, 6:26am UTC](https://discuss.elastic.co/t/logstash-and-kibana-for-app-log-files-recommendations/106769/2 "2017-11-08T06:26:20Z")

</div>

100 to 150 GB per... day? Or is that the largest amount you'll ever have to store?

---

<div class="post-metadata">

**Author:** ![VIJAY\_JOHN\_BRITTO](https://avatars.discourse-cdn.com/v4/letter/v/9d8465/32.png) [@VIJAY\_JOHN\_BRITTO](https://discuss.elastic.co/u/VIJAY_JOHN_BRITTO)\
**Post date:** [November 8, 2017, 3:24pm UTC](https://discuss.elastic.co/t/logstash-and-kibana-for-app-log-files-recommendations/106769/3 "2017-11-08T15:24:19Z")

</div>

That would be largest amount (100-150GB). Logs will be updated in miliseconds. We would also want to keep the latency as low as possible.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 8, 2017, 4:03pm UTC](https://discuss.elastic.co/t/logstash-and-kibana-for-app-log-files-recommendations/106769/4 "2017-11-08T16:03:39Z")

</div>

Okay. That's not much. I suspect a single Elasticsearch node is going to take you far.

---

<div class="post-metadata">

**Author:** ![VIJAY\_JOHN\_BRITTO](https://avatars.discourse-cdn.com/v4/letter/v/9d8465/32.png) [@VIJAY\_JOHN\_BRITTO](https://discuss.elastic.co/u/VIJAY_JOHN_BRITTO)\
**Post date:** [November 8, 2017, 4:17pm UTC](https://discuss.elastic.co/t/logstash-and-kibana-for-app-log-files-recommendations/106769/5 "2017-11-08T16:17:14Z")

</div>

Got it. Can we plan like below.

Node -1 .- 64GB RAM, 500 GB HDD with 4 CPU (Elastic Search and Logstash)  
Node -2 - 24 GB RAM, 200GB HDD with 4 CPU for Kibana

Can i have kibana and Logstash in same node?

Thanks  
Vijay

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 9, 2017, 6:59am UTC](https://discuss.elastic.co/t/logstash-and-kibana-for-app-log-files-recommendations/106769/6 "2017-11-09T06:59:53Z")

</div>

You don't need 24 GB RAM and 4 CPUs for Kibana.

> Can i have kibana and Logstash in same node?

Yes, of course.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2017, 7:00am UTC](https://discuss.elastic.co/t/logstash-and-kibana-for-app-log-files-recommendations/106769/7 "2017-12-07T07:00:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
