I am running a monolithic installation in a container (1 core, 4gb ram) that is being hosted by an intel NUC. I'm taking in about 100k records a day from 10-12 syslog sources and have no trouble with slow downs at all. (I do almost 0 processing of the incoming data, however.) I think I could lower the containers ram allocation to 2gb... maybe.
I haven't tried aggregating a years worth of data into a single search, but for reasonable log troubleshooting everything is going well.
I haven't tried aggregating a years worth of data into a single search, but for reasonable log troubleshooting everything is going well.