Hello everyone, My company is planning a pilot project to test Elastic Security (including Elasticsearch, Kibana, Logstash, and Fleet). We are also looking into integrating it with various third-party services. For this testing phase, we intend to deploy the entire stack on a single machine (All-i…

Let’s say, for 10 log sources with different integrations, 20 vCPU, 32gb RAM, 750gb NVMe SSD is the recommended baseline. You can go bigger if you can/want. Me and my team did it with almost this same requirements, but with each machine of their own in the stack.

Can you tell me if it will be possible to implement the placement of SIEM in our infrastructure based on SAS disks?

System requirements for Elastic Security "All-in-One" pilot deployment

Elastic Security SIEM

Christian_Dahlqvist (Christian Dahlqvist) April 3, 2026, 8:30am 4

I would strongly recommend that you use SSD disks as both indexing and querying in Elasticsearch can be very I/O intensive, especially at higher data volumes. NVMe SSD is ideal but SAS SSDs might also work. If you are considering using HDD I would strongly recommend against that.

2 Likes

Topic		Replies	Views
System requirements for ELK SIEM Elastic Security elastic-stack-monitoring , docker	2	1293	August 6, 2021
Infrarelated query Elastic Security	3	237	July 5, 2023
Sizing Elastic Stack for a PoC (security use case) Elastic Security	7	649	February 11, 2024
Elastic SIEM - Hardware specs Elastic Security	4	263	February 5, 2025
Reference architecture for running Elastic SIEM on Kubernetes Elastic Security docker	2	256	July 1, 2024

System requirements for Elastic Security "All-in-One" pilot deployment

Related topics