# Sizing Guide
**URL:** https://discuss.elastic.co/t/sizing-guide/388811
**Category:** Elastic Security
**Created:** [July 27, 2026, 11:27am UTC](https://discuss.elastic.co/t/sizing-guide/388811 "2026-07-27T11:27:33Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@jatin3101](https://discuss.elastic.co/u/jatin3101)
#### Post date: [July 27, 2026, 11:27am UTC](https://discuss.elastic.co/t/sizing-guide/388811/1 "2026-07-27T11:27:33Z")
I need an official documentation or any official way suggesting a rough log consumption estimate Gb/day for list of data sources --like i have list which include
firewall - count 10 - eps?-byte size?
switch - count 5 - eps?-byte size?
windows server -- count 100 - eps?-byte size?
etc
etc
so any documentation or any other official way that suggest that take the average eps for data source = x & average byte size = y so the formula becomes
GB/day = (Total EPS × Average Event Size × 86400) / 1024³
so i can help the client
---
### Author:  [@RainTown](https://discuss.elastic.co/u/RainTown)
#### Post date: [July 27, 2026, 12:07pm UTC](https://discuss.elastic.co/t/sizing-guide/388811/2 "2026-07-27T12:07:42Z")
Don't estimate it, measure it. Or help the client to measure it.
e.g. the firewall log volume will be completely dependent on what events you/they choose to log, how verbose, etc.
And, in elasticsearch context, the _peak_ volume, and its distribution over time, is almost as important as any daily average. I worked on a solution that averaged 1k EPS for 99% of the day, but 100k EPS for the other 1% (about 15 mins/day). During which period is it most important to know **quickly** if things are working well ?