Estimate Elasticsearch storage needs for an ELK stack from log volume and retention.
Elasticsearch storage for an ELK stack scales with raw log volume, the number of replica copies kept for resilience, the retention window, and how much the compression codec shrinks stored segments: storage = daily_volume × (1 + replicas) × retention ÷ compression_ratio. Replicas multiply storage directly since they're full copies of primary shard data, not just metadata.
totalStorage = dailyVolume × (1 + indexReplicas) × retentionDays / compressionRatio
The primary shard itself already accounts for 1× the data; each replica adds another full copy, so total copies = primaries + replicas = 1 + replica_count when there's exactly one replica setting applied uniformly.
Elasticsearch's default codec gives modest compression (~1.1-1.2×); switching to best_compression (DEFLATE) typically achieves 1.3-1.5× at the cost of some CPU and indexing/query latency.
The compression ratio in this model is meant to net out both compression savings and indexing overhead into a single effective multiplier — for a more precise model, benchmark actual index size vs. raw source size on your own data.
Yes — tiered storage often reduces replica count or compresses more aggressively on older tiers; run this calculation separately per tier for a more accurate total.