# New Cluster Hardware descision

**URL:** <https://discuss.elastic.co/t/new-cluster-hardware-descision/61918>\
**Category:** Elasticsearch\
**Created:** [September 30, 2016, 10:52am UTC](https://discuss.elastic.co/t/new-cluster-hardware-descision/61918 "2016-09-30T10:52:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![andreas\_at\_work](https://avatars.discourse-cdn.com/v4/letter/a/e9c0ed/32.png) [@andreas\_at\_work](https://discuss.elastic.co/u/andreas_at_work)\
**Post date:** [September 30, 2016, 10:52am UTC](https://discuss.elastic.co/t/new-cluster-hardware-descision/61918/1 "2016-09-30T10:52:56Z")

</div>

Hey folks,

we finally decided to order new hardware for our ES cluster. We are a IT-Security department and need the cluster to analyze "big" amount of log files in case of it security related incidents. The main problem is, that we do not know what kind logfiles we get until the incident occurs. Therefor we need a "general" ES cluster with the option to extend it within 1-2 years to the double size.

We are only allowed to decide between few preconfigured systems:  
System 1:

- CPU 2620v4
- Cores 8
- Cache 20MB
- Freq 2,1GHz
- RAM 64GB
- HD 2x960GB SSD

System 2:

- CPU 1230v5
- Cores 4
- Cache 8MB
- Freq 3,4GHz
- RAM 32GB
- HD 1x960GB SSD

Based on our Budget we may buy:  
6x System 1 OR  
10x System 2

Aggregated we have to decide between:  
**CPU 2620v4**  
**Cores 48**  
**Cache 120MB**  
**Freq 100,8GHz**  
**RAM 384GB**  
**HD 11,52TB**

and

**CPU 1230v5**  
**Cores 40**  
**Cache 80MB**  
**Freq 136GHz**  
**RAM 320GB**  
**HD 9,6TB**

The costs are equal. What would you recommend for a basic ES cluster?

Thank you  
Andreas

---

<div class="post-metadata">

**Author:** ![MarkOStewart](https://avatars.discourse-cdn.com/v4/letter/m/898d66/32.png) [@MarkOStewart](https://discuss.elastic.co/u/MarkOStewart)\
**Post date:** [September 30, 2016, 12:10pm UTC](https://discuss.elastic.co/t/new-cluster-hardware-descision/61918/2 "2016-09-30T12:10:09Z")

</div>

If you have to decide between the two last servers I would take # 1. Esp after you state they are the same $$$.

CPU 2620v4 **(a Gen down in CPU release but prob wont matter much here.)**  
Cores 48 **More cores = more time slices,**  
Cache 120MB **More cache**  
Freq 100,8GHz **Less cpu freq (my servers are not having much CPU load.)**  
RAM 384GB **More RAM (Elastic likes RAM)**  
HD 11,52TB **Bigger drive (Probably about the same performance with more space)**

This is my anecdotal experience. Others may have additional thoughts.

Mark

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:15pm UTC](https://discuss.elastic.co/t/new-cluster-hardware-descision/61918/3 "2017-07-05T22:15:49Z")

</div>