I have setup Graylog cluster (3 HOST) in docker and it’s running perfectly fine
32GB RAM for each host
4 CORE for each host
1.5 TB each host
i am expecting more than 100 application logs in graylog cluster in future, so I have central graylog for logging. my question is
per day I am expecting 120 GB logs per day in future so the current architecture is fine .
Retention time will be 30 days so 120GB*30= 3600 GB logs, is 3 server enough to handle that much of load (after adding additional disk space).
Graylog heap size
Elasticsearch heap size