PCF Log Search Resources

Resource Requirements

The following table shows the default resource and IP requirements for installing the tile:

Product Resource Instances CPU RAM Ephemeral Persistent Static IP Dynamic IP
Log Search Elasticsearch Master 1 1 2GB 8GB 5GB 1 0
Log Search Elasticsearch Data Node 2 1 6GB 8GB 50GB 2 0
Log Search Maintenance 1 1 1GB 8GB 0 1 0
Log Search Queue 1 1 2GB 8GB 5GB 1 0
Log Search Log Parser 2 1 2GB 8GB 0 2 0
Log Search Ingestor 1 1 2GB 8GB 0 1 0
Log Search Kibana 1 1 2GB 8GB 0 1 0
Log Search Cluster Monitor 1 2 4GB 8GB 10GB 1 0
Log Search Router 1 1 1GB 8GB 0 1 0
Log Search Firehose to Syslog 1 1 1GB 8GB 0 1 0
Log Search Enable Shard Allocation (Required) 1 1 1GB 8GB 0 0 1
Log Search Smoke Tests 1 1 1GB 8GB 0 0 1

Guidelines

  • If you use Firehose to consume application logs in addition to platform logs, you will probably need to scale up from the values above. See Find the Rate of Incoming Messages and then Scale Up Your Cluster.
  • You should use more log parser nodes than Elasticsearch data nodes.
  • Queue node should use less than 10% of memory. This indicates that the ingest rate is less than the parsing/indexing rate. If the queue node uses 10% memory or above, increase the number of parser nodes.
  • Data nodes should not be above 90% disk usage.