# Scaling ELK stack

**URL:** https://discuss.elastic.co/t/scaling-elk-stack/101416
**Category:** Logstash
**Created:** [September 22, 2017, 5:02am UTC](https://discuss.elastic.co/t/scaling-elk-stack/101416 "2017-09-22T05:02:36Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)
#### Post date: [September 22, 2017, 5:02am UTC](https://discuss.elastic.co/t/scaling-elk-stack/101416/1 "2017-09-22T05:02:36Z")

</div>

Hi,

I have ELK stack on AWS. It has capacity of around 5000 UDP msg/sec.

I want to scale it up to capacity of 20,000 msg/sec. What would be the recommended architecture for ELK stack.

Will it help If I keep N number of small instance installed logstash on all instance behind load balancer and keep Elasticsarch cluster on all instances or I keep bigger single instance.

And what option is better for future upgrade. ?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 22, 2017, 5:06am UTC](https://discuss.elastic.co/t/scaling-elk-stack/101416/2 "2017-09-22T05:06:49Z")

</div>

FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats feels left out 😉

If you are running Elasticsearch and Logstash together, splitting them out is definitely the first step. Using a load balancer also helps.

---

<div class="post-metadata">

### Author: ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)
#### Post date: [September 22, 2017, 5:12am UTC](https://discuss.elastic.co/t/scaling-elk-stack/101416/3 "2017-09-22T05:12:19Z")

</div>

Thank you :),  
Will definitely keep Logstash and Elasticsearch on separate machines .

What do you suggest about architecture. I currently run on 16 GB of memory, 4 core with capacity of around 4500 to 5000 msg/sec.

Do we just upgrade machine or we go for multiple smaller instances ?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 22, 2017, 5:27am UTC](https://discuss.elastic.co/t/scaling-elk-stack/101416/4 "2017-09-22T05:27:30Z")

</div>

You shouldn't need that much memory for Logstash, but it is CPU heavy. Having a few smaller ones is likely going to be more effective.

---

<div class="post-metadata">

### Author: ![manthan\_patel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/manthan_patel/32/48208_2.png) [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)
#### Post date: [September 22, 2017, 6:33am UTC](https://discuss.elastic.co/t/scaling-elk-stack/101416/5 "2017-09-22T06:33:12Z")

</div>

Thank you for help 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 20, 2017, 6:33am UTC](https://discuss.elastic.co/t/scaling-elk-stack/101416/6 "2017-10-20T06:33:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
