# Suricata - ELK stack **URL:** \ **Category:** Elasticsearch\ **Created:** [January 30, 2021, 2:54pm UTC](https://discuss.elastic.co/t/suricata-elk-stack/262715 "2021-01-30T14:54:34Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![nunex\_17](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Post date:** [January 30, 2021, 2:54pm UTC](https://discuss.elastic.co/t/suricata-elk-stack/262715/1 "2021-01-30T14:54:35Z")
Hi! I need to implement a IDS solution. I already have suriata running on a powerful physical serve, but i need to have the ELK stack on a different machine. Do you guys recommend any minimum system requirements for the ELK stack considering it will process a large amount of logs? ---
**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Post date:** [January 30, 2021, 4:46pm UTC](https://discuss.elastic.co/t/suricata-elk-stack/262715/2 "2021-01-30T16:46:55Z")
HI, I am far from an expert on this but the amount of information is too minimalistic. What do you consider large amount of log? How many event per second does that translate too? What are the retention requirements? do you need search results and if you do, how fast do you want them to be and in which search timeframe. As you can tell there are a lot, and I mean a lot of variables to work with. So unless you provide some requirements no one can anwser your question. ---
**Author:** ![nunex\_17](https://avatars.discourse-cdn.com/v4/letter/n/f17d59/32.png) [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Post date:** [January 30, 2021, 5:54pm UTC](https://discuss.elastic.co/t/suricata-elk-stack/262715/3 "2021-01-30T17:54:34Z")
Hi Of course, but i am still getting some data from different variables. So, until now it`s some where between 600 events per minute, 2 weeks of retention and i need to search results fast and for a 1 week period. ---
**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Post date:** [January 30, 2021, 6:26pm UTC](https://discuss.elastic.co/t/suricata-elk-stack/262715/4 "2021-01-30T18:26:17Z")
Hi, Thanks for you response but it doesn't help here.. 600 event p/m means nothing without sizing. For example, I have event that are 240kb but I also have events up to 1 mb. Your figures do not give any inside on your requirements. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 27, 2021, 6:26pm UTC](https://discuss.elastic.co/t/suricata-elk-stack/262715/5 "2021-02-27T18:26:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.