Hello the forum,
According to the table below, I saw that sising is a function of the amount of information (in GB/day) to be processed each day:
Acoording to you, what is the approximate volume (in GB/day) if I want to monitore:
Thank you for your answer.
wish it were that easy to size. But the roles, logging setup and traffic volume on those systems is more important.
the only piece of advice I would give you at this stage is to consider separating ES and GL from the beginning. This can absolutely be run on a single node, but I’ve found it easier to expand the solution if ES and GL are run on separate systems from the get go.
This is a duplicate of this thread:
If you want to evaluate load I would recommend you start with the prepackaged OVA so you can see how it performs and make scaling decisions from that.
if you want some real life data, my DIY graylog deployment is ingesting approximately 1.5 GB of logs per day, it’s single node with 16GB of RAM and 8core AMD fx cpu (basically a desktop PC from few years ago) aaand it doesn’t sweat much, graylog is limited to 3 cores (via docker) because it overheated cpu and it works flawlessly processing logs from our UTMs (HQ and few small remote locations) and servers (host linux server, windows domain servers etc), it’s deployed alongside a small TIG stack processing metrics from our servers
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
