Maybe to add more nodes on a single hardware box?

[learner]

Hi,

I have a single powerful hardware box that has 48 CPU cores and 254 GB of RAM to run the Elastic Stack 6.1.

And, I've assigned 3GB of heap for ES.

Otherwise, everything else has been left with the default configuration.

Every time my Kibana lookup makes me think that it's too slow and I'd better do something for better performance.

Is there any recommended configuration that I should have done at minimum to boost the performance on single hardware?

I'm just doing POC at the moment with Packetbeat on a NIC, which has been mirrored to get all the traffics on the switch side, and my OS load mostly remains very light, less than 7, on this 48 core box.

FYI, my "top" output shows as below:

and my data size is as below:

Thanks in advance!

• Young

[luiz.santos]

Hi Young,

You have a pretty big number of documents to use only 3Gb of RAM. As you have 256Gb available you could configure a 31gb heap (don't cross 32gb) for elasticsearch.

To ensure you have best performance please follow these recommendations too:
https://www.elastic.co/guide/en/elasticsearch/reference/current/system-config.html

Cheers,
LG

[learner]

Hi Luiz,

Excellent! Thank you very much.