Graylog Labs Video - Reference Architecture

@ihe, are you referring to how much data will be stored to Opensearch? The ingestion is measured just before insertion into Opensearch, but the actual bytes stored varies, based on the type of data you are collecting and how it is organized in your indices.

For calculating storage requirements, take the number of days you wish to retain the data, multiply by the amount of data you are ingesting, and then multiply that by 1.3. This allows for headroom in Opensearch.

Ingest Rate (GB) * Days Retained * 1.3

A word of warning, you need to allow for LOTS of slack space in OS/ES. If you haven’t read the thread about watermarks on the board, go find it. Or just google it for a good explanation from Elastic.

For purposes of calculation, we recommend you always leave at least 25% of disk space free. The watermarks kick in at 85% by default, so that gives you a little space if storage gets close to the limits. The way I like to think about it is that 75% used is 100% full.