# Which is better: many small instances vs one single beefy instance for real-time indexing and query?

**URL:** <https://discuss.elastic.co/t/which-is-better-many-small-instances-vs-one-single-beefy-instance-for-real-time-indexing-and-query/8305>\
**Category:** Elasticsearch\
**Created:** [July 4, 2012, 3:17am UTC](https://discuss.elastic.co/t/which-is-better-many-small-instances-vs-one-single-beefy-instance-for-real-time-indexing-and-query/8305 "2012-07-04T03:17:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonathan\_Moo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jonathan_moo/32/2562_2.png) [@Jonathan\_Moo](https://discuss.elastic.co/u/Jonathan_Moo)\
**Post date:** [July 4, 2012, 3:17am UTC](https://discuss.elastic.co/t/which-is-better-many-small-instances-vs-one-single-beefy-instance-for-real-time-indexing-and-query/8305/1 "2012-07-04T03:17:55Z")

</div>

Just to give a background, I am currently using a Logstash setup, hence my  
current version of Elasticsearch (ES) is at 18.7. Everything is housed  
under one large instance in AWS [http://aws.amazon.com/ec2/instance-types/](http://aws.amazon.com/ec2/instance-types/),  
having only 300gb of EBS Volume [http://aws.amazon.com/ebs/](http://aws.amazon.com/ebs/). Going to  
switch to S3 storage [http://aws.amazon.com/s3/](http://aws.amazon.com/s3/)once I scale.

There are 30 rolling indices in my ES instance, each index represents one  
day of record and I combined 3 servers' worth of logs into a rolling index  
daily. I am chalking up at least 150gb to 210gb in this ES instance, each  
index at least having 5gb.

I am asked to scale this project to house more servers' logs, but I'm not  
sure which route to go. I have problems querying facets in real-time per  
minute because it takes up too much RAM just to query the data and to put  
them into a graph, but I hope to scale it such that I could create a date  
histogram per minute on 30 days into 1 graph.

So which route should I take? Many small instances of ES or one single  
beefy AWS/ES instance for my use-case? I need it to be as cost-efficient as  
possible.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 3:21am UTC](https://discuss.elastic.co/t/which-is-better-many-small-instances-vs-one-single-beefy-instance-for-real-time-indexing-and-query/8305/2 "2017-07-06T03:21:35Z")

</div>