Hacker News Reader

bmurphy1976

Do you really need a large cluster?

We run our ELK stack (elastic search+logstash+kibana+3 days of logs) on a single EC2 ephemeral instance inside an auto-scaling group. If we lose our logs, oh well! Given that we lose this instance every two-ish years, it seems like a reasonable tradeoff.

View on HN

Well, we use Elasticsearch extensively for our applications and have developed our internal best practices for running it. A single instance is not recommended for ES. If you're totally fine with losing logs, I guess it's okay, but logs are a critical part of production infra for us and so we would either run a larger cluster with data-only and master-only nodes for optimum reliability.

Amazon now offers Elasticsearch as a service; it was a great help for us quickly setting up ELK to test.

Yes, but it's limited to version 1.5.2. Given the backwards-incompatible changes in 2.X, that can be a deal-breaker for many people, sadly.

Reply on news.ycombinator.com