The allocation of machines for different in ELK

I have 5 machines to form a elasticsearch cluster. How should I use them in order to maximise the performance?
Should I install elasticsearch and logstash on each machine and install kibana on one of them? or should I install elasticsearch on three of them to from a cluster and install logstash on remaining two and install kibana on anyone of them? Please help

What is the specification of the machines? What is the use case?

We have around 15 aws machines around the world. They generate 1.5 billions line of log everyday. We have 5 spare desktop pc at our offices. Their spec are around i7 7th gen with 32 GB RAM and 1TB SSD. We hope to create a ELK cluster to collect those log as much as we can.
So...what is the best allocation in this use case?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.