If you are running a version of ElasticSearch that is different from what came with metron Apache Metron 0.4.2 and older, the below information is outdated.  As of METRON-939, ElasticSearch and Kibana have been upgraded and the below guide may no longer be accurate.

Sizing your hardware

Elasticsearch prefers to run on a large number of small servers, as opposed to multiple instances on big servers.  See this great post for more details.

...