# Sizing question **URL:** \ **Category:** Elasticsearch\ **Created:** [March 4, 2016, 5:06pm UTC](https://discuss.elastic.co/t/sizing-question/43536 "2016-03-04T17:06:58Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Bruno\_Lavoie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno_lavoie/32/8408_2.png) [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Post date:** [March 4, 2016, 5:06pm UTC](https://discuss.elastic.co/t/sizing-question/43536/1 "2016-03-04T17:06:58Z")
Hello, We are storing firewall logs from our networking infrastructure. The biggest user is the fortigate one with this biggest seen daily usage: - 135 GB - 173 332 370 documents But the average is around 60 GB with a standard deviation of 30 GB We're going to buy a new cluster with these specs: - 5 nodes with each: -- 96 GB RAM (the more the better for FS Cache) -- 30 GB heap each (near the recommended maximum) -- 10000 Write IOPS capacity -- 4 TB storage -- 2 CPUS 12 Cores Other indices will be much smaller... Buf, with thes fact at hand, is our setup seems to be ok? Or our servers are too much dense in storage capacity and should go with more, less beefy nodes? Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 4, 2016, 6:23pm UTC](https://discuss.elastic.co/t/sizing-question/43536/2 "2016-03-04T18:23:18Z")
How many days of logs are you planning on keeping around? ---
**Author:** ![Bruno\_Lavoie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno_lavoie/32/8408_2.png) [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Post date:** [March 4, 2016, 7:05pm UTC](https://discuss.elastic.co/t/sizing-question/43536/3 "2016-03-04T19:05:01Z")
90 days retention ---
**Author:** ![Bruno\_Lavoie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno_lavoie/32/8408_2.png) [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Post date:** [March 4, 2016, 8:16pm UTC](https://discuss.elastic.co/t/sizing-question/43536/4 "2016-03-04T20:16:39Z")
90 days of data ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 4, 2016, 9:25pm UTC](https://discuss.elastic.co/t/sizing-question/43536/5 "2016-03-04T21:25:07Z")
That seems sane based on what I've seen. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:11pm UTC](https://discuss.elastic.co/t/sizing-question/43536/6 "2017-07-05T23:11:04Z")