Sizing the ELK stack

[ericd]

Hello to everyone,

I have a need to design a ELK stack and two not-heavy web applications (served by nginx).
Ingress rate for logstash will be around 1000EPS (later maybe up to 2000EPS).

How i can monitor this rate without buying x-pack?
Is it enough for my environment to build just one virtual server (ES data+master node, Logstash, Kibana, nginx).
What will be resources requests for this EPS rate?
My 16GB ram, 8Cpu cores and 500GB disk space.
Mostly i ask for RAM and CPU.

[warkolm (Mark Walkom)]

FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats feels left out

@ericd

How i can monitor this rate without buying x-pack?

Monitoring is free, just register for a license and you are set!

[quote="ericd, post:1, topic:102224"]
Is it enough for my environment to build just one virtual server (ES data+master node, Logstash, Kibana, nginx).
[/quote

You should test to see really, but you will be able to hold a reasonable amount of data with that hardware.

[ericd]

Thank you.

I saw X-pack license trial is 30 days. If there is no constraints for monitoring, that is enough for me.

What can be the bottleneck in this configuration, RAM or CPU?
I will lock 50% (8GB) for heap space.
Number of indices is around 90 (three indices for one month)

[warkolm (Mark Walkom)]

Probably RAM most likely.

[ericd]

Thank you.

For renaming ELK to ELastic, you favorized Elasticsearch. Maybe the BELK would be more fair, if only Beats complains

[warkolm (Mark Walkom)]

Maybe, but what about APM!

[ericd]

BELKA