Hardware Requirement

[adhyayan07]

Any specific Hardware Requirements for elastalert like total CPU cores and amount of RAM required?

[jertel]

There are no specific hardware requirements. It will run on a single core with negligible memory usage. However, you will need to provision the Elasticsearch with sufficient hardware in order to support the types of alerting queries you plan to configure for ElastAlert 2. For example, if you expect to have hundreds of rules querying large indexes across long time spans then you will need a very powerful server, or cluster of servers powering Elasticsearch. More details are available in the Elasticsearch documentation.

[nsano-rururu]

I will share what I have verified in the past.

One masternode for k8s. Using Elasticsearch's Heatbeat, we experimented with six worker nodes to collect Metricbeat, application logs, etc. using Filebeat, Fluentd, and life-and-death monitoring.

Initially I needed t3.medium (2 CPUs, 4G memory) for AWS EC2, and two months later I needed t3.xlarge (4 CPUs, 16G memory). The disc should be about 20G at the beginning and about 60G at the end.
Metricbeat should be a collection every 30 minutes.
Metricbeat information squeezed the disc. As the amount of data in Elasticsearch increased, ElastAlert stopped working properly.
As a workaround, on the Kibana screen, I set Index Lifecycle Management (ILM) to delete unnecessary indexes on a regular basis, and now it works comfortably.

From the above, when a large amount of data is registered in the index, it will not work properly if the CPU / Memory specifications are low when the Elast Alert rule works. It is recommended to perform actual operation after finding a stable state by verification so that the index does not increase more than a certain amount.

[nsano-rururu]

@thepaleviper

The required specifications cannot be known without verification with data close to the actual production. Try it for yourself.