The Log Aggregation feature uses the Elastic Search Stack.

Elasticsearch servers need a balance between CPU and RAM in a 1:2 ratio. The needed resources depend on how many logs are ingested per seconds, how complex are the filters that are used and how long are the ranges used to filter logs.

For example if you choose to apply a filter on all logs from the last month you can experience delayed responses or even failed responses if the resources are not enough.

Did this answer your question?