Chapter 11: Designing an ELK Stack

1. At least 2 CPU cores are needed for optimal functionality on smaller deployments.
2. At least 2Ghz.
3. Slower or less than 2 CPUs impact mostly Elasticsearch startup time, indexing rate and latency.
4. The kernel uses available RAM for caching requests to the filesystem.
5. If swapping occurs, search latency will be greatly impacted.
6. Elasticsearch will fail to start if there’s not enough memory, once running if there’s not sufficient memory OOM will kill Elasticsearch.
7. The minimum is 2.5GB but 4GB is recommended.
8. /var/lib/elasticsearch
9. Lower latency helps with the indexing/ search latency.
10. 2GB RAM and 1 CPU.
11. This is a storage location where logstash will persistently store queues in the scenario of a crash.
12. How many users will access concurrently the dashboard.