# Sizing the ELK stack

**URL:** <https://discuss.elastic.co/t/sizing-the-elk-stack/102224>\
**Category:** Elasticsearch\
**Created:** [September 29, 2017, 8:12am UTC](https://discuss.elastic.co/t/sizing-the-elk-stack/102224 "2017-09-29T08:12:27Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![ericd](https://avatars.discourse-cdn.com/v4/letter/e/58f4c7/32.png) [@ericd](https://discuss.elastic.co/u/ericd)\
**Post date:** [September 29, 2017, 8:12am UTC](https://discuss.elastic.co/t/sizing-the-elk-stack/102224/1 "2017-09-29T08:12:27Z")

</div>

Hello to everyone,

I have a need to design a ELK stack and two not-heavy web applications (served by nginx).  
Ingress rate for logstash will be around 1000EPS (later maybe up to 2000EPS).

How i can monitor this rate without buying x-pack?  
Is it enough for my environment to build just one virtual server (ES data+master node, Logstash, Kibana, nginx).  
What will be resources requests for this EPS rate?  
My 16GB ram, 8Cpu cores and 500GB disk space.  
Mostly i ask for RAM and CPU.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 29, 2017, 8:56am UTC](https://discuss.elastic.co/t/sizing-the-elk-stack/102224/2 "2017-09-29T08:56:41Z")

</div>

FYI we’ve renamed ELK to the Elastic Stack, otherwise Beats feels left out 😉

> [@ericd](#):
>
> How i can monitor this rate without buying x-pack?

Monitoring is free, just register for a license and you are set!

[quote="ericd, post:1, topic:102224"]  
Is it enough for my environment to build just one virtual server (ES data+master node, Logstash, Kibana, nginx).  
[/quote

You should test to see really, but you will be able to hold a reasonable amount of data with that hardware.

---

<div class="post-metadata">

**Author:** ![ericd](https://avatars.discourse-cdn.com/v4/letter/e/58f4c7/32.png) [@ericd](https://discuss.elastic.co/u/ericd)\
**Post date:** [September 29, 2017, 9:05am UTC](https://discuss.elastic.co/t/sizing-the-elk-stack/102224/3 "2017-09-29T09:05:35Z")

</div>

Thank you.

I saw X-pack license trial is 30 days. If there is no constraints for monitoring, that is enough for me.

What can be the bottleneck in this configuration, RAM or CPU?  
I will lock 50% (8GB) for heap space.  
Number of indices is around 90 (three indices for one month)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 29, 2017, 10:11am UTC](https://discuss.elastic.co/t/sizing-the-elk-stack/102224/4 "2017-09-29T10:11:34Z")

</div>

Probably RAM most likely.

---

<div class="post-metadata">

**Author:** ![ericd](https://avatars.discourse-cdn.com/v4/letter/e/58f4c7/32.png) [@ericd](https://discuss.elastic.co/u/ericd)\
**Post date:** [September 29, 2017, 10:18am UTC](https://discuss.elastic.co/t/sizing-the-elk-stack/102224/5 "2017-09-29T10:18:23Z")

</div>

Thank you.

For renaming ELK to ELastic, you favorized Elasticsearch. Maybe the BELK would be more fair, if only Beats complains 🙂

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 29, 2017, 10:19am UTC](https://discuss.elastic.co/t/sizing-the-elk-stack/102224/6 "2017-09-29T10:19:26Z")

</div>

Maybe, but what about APM! 😛

---

<div class="post-metadata">

**Author:** ![ericd](https://avatars.discourse-cdn.com/v4/letter/e/58f4c7/32.png) [@ericd](https://discuss.elastic.co/u/ericd)\
**Post date:** [September 29, 2017, 10:31am UTC](https://discuss.elastic.co/t/sizing-the-elk-stack/102224/7 "2017-09-29T10:31:42Z")

</div>

BELKA 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 27, 2017, 10:31am UTC](https://discuss.elastic.co/t/sizing-the-elk-stack/102224/8 "2017-10-27T10:31:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
