# Recommended ELK architecture for production? **URL:** \ **Category:** Elasticsearch\ **Created:** [October 11, 2016, 7:02pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747 "2016-10-11T19:02:47Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Post date:** [October 11, 2016, 7:02pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/1 "2016-10-11T19:02:47Z")
Is there a recommended "minimal" ELK architecture for production? I know, I know, this depends In my case, I want to set up a central ELK stack where we can send our application logs (via rsyslog) to the stack. Here is my production environment - 6-8 customer sites - Each site will have up to 6 application servers - Each application server can have 'up to" 150MB of "rolling" log data - We have to retain the data for up to 3 months I'm thinking, 4 servers? - 3 Elasticsearch servers to form the cluster - 1 server for both Kibana and Logstash Feedback? Is there a guideline available? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 12, 2016, 12:07am UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/2 "2016-10-12T00:07:30Z")
That sounds ok. The biggest thing you need to watch is over sharding. ---
**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Post date:** [October 12, 2016, 8:15am UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/3 "2016-10-12T08:15:40Z")
If you don't want missing log, I recommend you shoud be have one message queue. like kafka, rabbitm-mq ---
**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Post date:** [October 14, 2016, 6:01pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/4 "2016-10-14T18:01:14Z")
In an ES cluster, what IP do I put in Logstash's output's elasticsearch configuration? IOW, do I do this? ``` output { elasticsearch { hosts => ["es_host1", "es_host2", "es_host3"] } } ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 14, 2016, 9:23pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/5 "2016-10-14T21:23:04Z")
Yep! ---
**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Post date:** [October 16, 2016, 2:25am UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/6 "2016-10-16T02:25:29Z")
Thanks! ---
**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Post date:** [October 27, 2016, 10:12pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/7 "2016-10-27T22:12:26Z")
On the 1 server that houses Kibana and Logstash, do I need to install Elasticsearch on it too, but set it up as a client node? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 27, 2016, 10:54pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/8 "2016-10-27T22:54:29Z")
You don't have to, but it's not a bad idea. ---
**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Post date:** [October 28, 2016, 7:42pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/9 "2016-10-28T19:42:51Z")
The following line "Essentially, client nodes behave as smart load balancers." from [Elasticsearch nodes](https://www.elastic.co/guide/en/elasticsearch/reference/2.4/modules-node.html#client-node) convinced me to install ES on the server with Kibana and Logstash on it, and run it as a client node. ---
**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Post date:** [November 2, 2016, 7:30pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/10 "2016-11-02T19:30:30Z")
So in this configuration, where I have a client node. should the logstash output plugin point to the client node? ``` output { elasticsearch { hosts => ["es_client_node_ip"] } } ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 2, 2016, 10:01pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/11 "2016-11-02T22:01:24Z")
Yep! ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 3, 2016, 6:34am UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/12 "2016-11-03T06:34:37Z")
Having a single client node will however introduce a single point of failure. You can provide a list of hosts to Logstash and recent versions also support sniffing, meaning they can find new nodes being added to the cluster, so having a client node with Logstash is usually not required. ---
**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Post date:** [November 3, 2016, 2:05pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/13 "2016-11-03T14:05:18Z")
@Christian_Dahlqvist, thanks for the advice. I'm evaluating all these options now. For Logstash, I may end up not using the Elasticsearch client. With Kibana. how do I set up kibana.yml if I don't use a client, that is, what would be the value of "elasticsearch.url" for a 3-node cluster? Do I just point it to one of the nodes in the cluster? With a client node, I point Kibana to the client node right? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 3, 2016, 2:40pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/14 "2016-11-03T14:40:17Z")
Kibana, unlike Logstash, do benefit from a client node or a load balancer. ---
**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Post date:** [November 3, 2016, 9:35pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/15 "2016-11-03T21:35:43Z")
You are indeed correct. From [Using Kibana in a Production Environment](https://www.elastic.co/guide/en/kibana/current/production.html) > If you have multiple nodes in your Elasticsearch cluster, the easiest way to distribute Kibana requests across the nodes is to run an Elasticsearch client node on the same machine as Kibana. Elasticsearch client nodes are essentially smart load balancers that are part of the cluster. They process incoming HTTP requests, redirect operations to the other nodes in the cluster as needed, and gather and return the results. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:06pm UTC](https://discuss.elastic.co/t/recommended-elk-architecture-for-production/62747/16 "2017-07-05T22:06:44Z")