PCF Log Search Resources
Resource Requirements
The following table shows the default resource and IP requirements for installing the tile:
Product | Resource | Instances | CPU | RAM | Ephemeral | Persistent | Static IP | Dynamic IP |
---|---|---|---|---|---|---|---|---|
Log Search | Elasticsearch Master | 1 | 1 | 2GB | 8GB | 5GB | 1 | 0 |
Log Search | Elasticsearch Data Node | 2 | 1 | 6GB | 8GB | 50GB | 2 | 0 |
Log Search | Maintenance | 1 | 1 | 1GB | 8GB | 0 | 1 | 0 |
Log Search | Queue | 1 | 1 | 2GB | 8GB | 5GB | 1 | 0 |
Log Search | Log Parser | 2 | 1 | 2GB | 8GB | 0 | 2 | 0 |
Log Search | Ingestor | 1 | 1 | 2GB | 8GB | 0 | 1 | 0 |
Log Search | Kibana | 1 | 1 | 2GB | 8GB | 0 | 1 | 0 |
Log Search | Cluster Monitor | 1 | 2 | 4GB | 8GB | 10GB | 1 | 0 |
Log Search | Router | 1 | 1 | 1GB | 8GB | 0 | 1 | 0 |
Log Search | Firehose to Syslog | 1 | 1 | 1GB | 8GB | 0 | 1 | 0 |
Log Search | Enable Shard Allocation (Required) | 1 | 1 | 1GB | 8GB | 0 | 0 | 1 |
Log Search | Smoke Tests | 1 | 1 | 1GB | 8GB | 0 | 0 | 1 |
Guidelines
- If you use Firehose to consume application logs in addition to platform logs, you will probably need to scale up from the values above. See Find the Rate of Incoming Messages and then Scale Up Your Cluster.
- You should use more log parser nodes than Elasticsearch data nodes.
- Queue node should use less than 10% of memory. This indicates that the ingest rate is less than the parsing/indexing rate. If the queue node uses 10% memory or above, increase the number of parser nodes.
- Data nodes should not be above 90% disk usage.