# Prerequisites for ELK and Filebeat

**URL:** <https://discuss.elastic.co/t/prerequisites-for-elk-and-filebeat/248946>\
**Category:** Kibana\
**Created:** [September 17, 2020, 9:14am UTC](https://discuss.elastic.co/t/prerequisites-for-elk-and-filebeat/248946 "2020-09-17T09:14:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sumitsahay](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sumitsahay](https://discuss.elastic.co/u/sumitsahay)\
**Post date:** [September 17, 2020, 9:14am UTC](https://discuss.elastic.co/t/prerequisites-for-elk-and-filebeat/248946/1 "2020-09-17T09:14:12Z")

</div>

Hi Team,

Just wanted to know the CPU and RAM Prerequisites for ELK and Filebeat, if we deploy this in Infra where we can captures log around 500 client node.

Please suggest the configuration for this.

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 17, 2020, 10:05pm UTC](https://discuss.elastic.co/t/prerequisites-for-elk-and-filebeat/248946/2 "2020-09-17T22:05:40Z")

</div>

That depends on what data you are collecting with Filebeat.

---

<div class="post-metadata">

**Author:** ![sumitsahay](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sumitsahay](https://discuss.elastic.co/u/sumitsahay)\
**Post date:** [September 18, 2020, 12:52am UTC](https://discuss.elastic.co/t/prerequisites-for-elk-and-filebeat/248946/3 "2020-09-18T00:52:37Z")

</div>

Basically we are collecting error logs, https access logs and few application logs that is running on the client machine.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 18, 2020, 12:53am UTC](https://discuss.elastic.co/t/prerequisites-for-elk-and-filebeat/248946/4 "2020-09-18T00:53:24Z")

</div>

Start with a 3 node cluster with 4-8GB of heap and you should be good.

---

<div class="post-metadata">

**Author:** ![sumitsahay](https://avatars.discourse-cdn.com/v4/letter/s/67e7ee/32.png) [@sumitsahay](https://discuss.elastic.co/u/sumitsahay)\
**Post date:** [September 18, 2020, 12:55am UTC](https://discuss.elastic.co/t/prerequisites-for-elk-and-filebeat/248946/5 "2020-09-18T00:55:05Z")

</div>

Do you thing for more then 500 client machine it is enough?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 18, 2020, 12:56am UTC](https://discuss.elastic.co/t/prerequisites-for-elk-and-filebeat/248946/6 "2020-09-18T00:56:10Z")

</div>

That'll depend on how long you want to store the data for.

I would start there, see how much data you generate, and extrapolate from there.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 16, 2020, 12:56am UTC](https://discuss.elastic.co/t/prerequisites-for-elk-and-filebeat/248946/7 "2020-10-16T00:56:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.