# Topology configuration in medium seized cluster

**URL:** <https://discuss.elastic.co/t/topology-configuration-in-medium-seized-cluster/89548>\
**Category:** Elasticsearch\
**Created:** [June 15, 2017, 12:01pm UTC](https://discuss.elastic.co/t/topology-configuration-in-medium-seized-cluster/89548 "2017-06-15T12:01:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Habitats](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/habitats/32/12796_2.png) [@Habitats](https://discuss.elastic.co/u/Habitats)\
**Post date:** [June 15, 2017, 12:01pm UTC](https://discuss.elastic.co/t/topology-configuration-in-medium-seized-cluster/89548/1 "2017-06-15T12:01:58Z")

</div>

We have a small business running a medium sized ES v2.3.1 cluster currently consisting of 7 nodes with 8 CPUs and 30gb of RAM.

There are two types of data being stored:

- Static indices of 20M records (about 20gb each), 5 shards, 0 replica per index
- Streaming day-based indices of 25gb each, 5 shards per index, 1 replica (spread over 6/7 nodes)

At the moment our topolgy if simply making all of the servers master/data/client and then letting it do its thing. No dedicated nodes for anything.

The cluster currently indexes 30 items/second, and serves up to 1000 queries per second, and the total size of the cluster is now around 3TB on HDDs.

Our cluster is however not performing very well, and we want to optimize it but are unsure of what to do. Our options as I see it is:

- Add more nodes
- Use dedicated master/client/data nodes (if yes, which topology?)
- Use SSDs

Any suggestion as to how we should proceed?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 18, 2017, 7:41am UTC](https://discuss.elastic.co/t/topology-configuration-in-medium-seized-cluster/89548/2 "2017-06-18T07:41:17Z")

</div>

> [@Habitats](#):
>
> Our cluster is however not performing very well

What does that mean exactly?  
How are you measuring this?

---

<div class="post-metadata">

**Author:** ![Habitats](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/habitats/32/12796_2.png) [@Habitats](https://discuss.elastic.co/u/Habitats)\
**Post date:** [June 18, 2017, 12:34pm UTC](https://discuss.elastic.co/t/topology-configuration-in-medium-seized-cluster/89548/3 "2017-06-18T12:34:29Z")

</div>

What I was trying to say is that our cluster is currently not fulfilling our business requirements, and we need to improve/scale it (mainly searches taking too much time, we have a lot of complicated queries).

But, before just throwing more hardware at it, I'm trying to figure out if there's something that can be done on a lower lever, like improving the topology.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 18, 2017, 12:40pm UTC](https://discuss.elastic.co/t/topology-configuration-in-medium-seized-cluster/89548/4 "2017-06-18T12:40:48Z")

</div>

Have you identified anything that is limiting performance? What does CPU utilization and disk I/O, e.g. iowait, look like?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2017, 12:41pm UTC](https://discuss.elastic.co/t/topology-configuration-in-medium-seized-cluster/89548/5 "2017-07-16T12:41:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.