News for hackers. Stuff that matters.

A comment on Logstash joins Elasticsearch. Parent comment

Re:Logstash joins Elasticsearch by nasalgoat on Wednesday August 28, 2013 @07:25AM (#6289152)
The one thing Splunk has going for it over ES is the amount of resources it requires to work at scale.

I needed 12 ES boxes for every one Splunk box to handle the 100MB/day log load of my system, and even then they ran at a high load and searches often failed, and in some cases it took hours for the indexer to catch up.

[ Parent | on HN ]
Re:Logstash joins Elasticsearch by jordansissel on Wednesday August 28, 2013 @07:03PM (#6293222)
This experience sounds especially bad. Sorry about that.

As mentioned in another comment in this post, I was doing 300gigs of data per day with an elasticsearch cluster size of 7 elasticsearch nodes (16 cores & 16gb ram per node) and load was around 5-10% cpu utilization.

100MB/day is pretty small in terms of log data, I think. If you attempt this again, please invoke the community (elasticsearch's is great!) and see if we can assist you in figuring out what's busted.

[ Parent | on HN ]