I would like to implement the elk stack for log management for a SIEM.
In a production context I would like to create a cluster of 3 elastic nodes.
What are your advices and best practices?
2 x node.roles: [ master, voting_only, ... ]
1 x node.roles: [ master, voting_only, data ... ]
How many nodes for logstash?
And for kibana?
And what are the hardware recommendations for each node in a virtualized environment?
Number of cores? RAM? How many disks? What size?
Thank you very much in advance for your advice