Graylog open - High performance


I have Dell R740 with 2nd Generation Intel® Xeon® Scalable processors, up to 28 cores per processor,
64GB RAM, 60TB SAS 10K disk.
My question is this server will be able to handle 100K EPS?
If yes. what is the best practice structure should I use?



It sounds like it should, to be honest seams like a lot just for one server. In our case we would take your Dell server and either put Windows Server 2019 Hyper-v and/or KVM on it then running Graylog Virtual machines. We aso would use Architectural considerations from Graylog Documents.

Architectural considerations.

Our environment we would start off with 3 ES nodes and 3 GL/MongoDb nodes. If those 6 nodes cant handle it its easy with VM’s just to add more resources or add more nodes to your cluster.
Hope that helps.

Hmmmm…on a single server? Not likely. Especially not with a spinning disk. You’re looking at a multiple node deployment.

It’s worth noting that just saying “100k EPS” leaves a lot of detail out. How big are those events? What do you plan on doing with them? Are you going to use a lot of pipeline rules? What about extractors or stream rules?

What about Elasticsearch? MongoDB? What’s your load balancing strategy look like? A single server isn’t really going to cut it IMO.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.