Do you really need a large cluster?<p>We run our ELK stack (elastic search+logstash+kibana+3 days of logs) on a single EC2 ephemeral instance inside an auto-scaling group.  If we lose our logs, oh well! Given that we lose this instance every two-ish years, it seems like a reasonable tradeoff.