adding reference architecture section

Author: georgewallace

docs/en/reference-architecture/elastic-cloud-architecture.asciidoc

@@ -0,0 +1,170 @@
+[[elastic-cloud-architecture]]
+== Elastic Cloud Hot-Frozen Architecture for Time Series Data
+++++
+<titleabbrev>Architecture: Elastic Cloud hot-frozen</titleabbrev>
+++++
+
+The Hot-Frozen Elasticsearch cluster architecture is cost optimized for large time-series datasets while keeping all of the data **fully searchable**. There is no need to "re-hydrate" archived data. In this architecture, the hot tier is primarily used for indexing and immediate searching (1-3 days) with a majority of the search being handled by the frozen tier. Since the data is moved to searchable snapshots in an object store, the cost of keeping all of the data searchable is dramatically reduced.
+
+TIP: This architecture includes all the essential components of the Elastic Stack. It's designed to ensure your deployment has a stable foundation, based on expert recommendations, but is not intended for sizing workloads.
+
+The most important foundational step to any architecture is designing your deployment to be responsive to production workloads. For more information on planning for production, see https://www.elastic.co/guide/en/elasticsearch/reference/current/scalability.html[Get ready for production].
+
+[discrete]
+[[cloud-hot-use-case]]
+=== Use case
+
+This architecture is intended for organizations that need to do the following:
+
+* Monitor the performance and health of their applications in real time, including the creation and tracking of SLOs (Service Level Objectives).
+* Provide insights and alerts to ensure optimal performance and quick issue resolution for applications.
+* Apply machine learning and artificial intelligence to assist engineers and application teams in dealing with terabytes of new data per day.
+
+
+[discrete]
+[[cloud-hot-frozen-architecture]]
+=== Architecture
+
+image::images/elastic-cloud-architecture.png["An Elastic Cloud Architecture"]
+
+[discrete]
+[[cloud-hot-frozen-configuration]]
+=== Example configuration
+
+The following is a sample configuration with the following specifications:
+
+* An ingest rate of 1TB/day
+* 1 day in the hot tier
+* 89 days in the frozen tier
+* A total of 90 days of searchable data
+
+[discrete]
+[[cloud-hot-frozen-aws]]
+==== AWS
+
+* Hot tier: 120G RAM (2 60G RAM node x 3 pods x 2 availability zones)
+* Frozen tier: 120G RAM (1 60G RAM node x 3 pods x 2 availability zones)
+* Machine learning: 128G RAM (1 64G node x 3 pods x 2 availability zones)
+* Master nodes: 24G RAM (8G node x 3 pods x 2 availability zones) 
+* Kibana: 16G RAM (16G node x 3 pods x 2 availability zones)
+
+[discrete]
+[[cloud-hot-frozen-azure]]
+==== Azure
+
+* Hot tier: 120G RAM (2 60G RAM node x 3 pods x 2 availability zones)
+* Frozen tier: 120G RAM (1 60G RAM node x 3 pods x 2 availability zones)
+* Machine learning: 128G RAM (1 64G node x 3 pods x 2 availability zones)
+* Master nodes: 24G RAM (8G node x 3 pods x 2 availability zones) 
+* Kibana: 16G RAM (16G node x 3 pods x 2 availability zones)
+
+[discrete]
+[[cloud-hot-frozen-gcp]]
+==== GCP
+
+* Hot tier: 120G RAM (2 60G RAM node x 3 pods x 2 availability zones)
+* Frozen tier: 120G RAM (1 60G RAM node x 3 pods x 2 availability zones)
+* Machine learning: 128G RAM (1 64G node x 3 pods x 2 availability zones)
+* Master nodes: 24G RAM (8G node x 3 pods x 2 availability zones) 
+* Kibana: 16G RAM (16G node x 3 pods x 2 availability zones)
+
+[discrete]
+[[cloud-hot-frozen-recommended-instance-types]]
+==== Recommended instance types per cloud provider
+
+The following table details our recommended node types for this architecture, based on the hardware configurations described previously.
+
+For more details on these instance types, see our documentation on Elastic Cloud hardware for https://www.elastic.co/guide/en/cloud/current/ec-default-aws-configurations.html[AWS], https://www.elastic.co/guide/en/cloud/current/ec-default-azure-configurations.html[Azure], and https://www.elastic.co/guide/en/cloud/current/ec-default-gcp-configurations.html[GCP].
+
+[cols="10, 30, 30, 30"]
+|===
+| *Type* | *AWS Instance/Type* | *Azure Instance/Type* | *GCP Instance/Type*
+|image:images/hot.png["An Elastic Cloud Architecture"] | aws.es.datahot.c6gd
+c6gd |azure.es.datahot.fsv2
+f32sv2|gcp.es.datahot.n2.68x32x45
+
+
+N2
+|image:images/frozen.png["An Elastic Cloud Architecture"]
+| aws.es.datafrozen.i3en
+
+
+i3en
+|
+azure.es.datafrozen.edsv4
+
+
+e8dsv4
+|
+gcp.es.datafrozen.n2.68x10x95
+
+
+N2
+|image:images/machine-learning.png["An Elastic Cloud Architecture"]
+| aws.es.ml.m6gd
+
+
+m6gd
+|
+azure.es.ml.fsv2
+
+
+f32sv2
+|
+gcp.es.ml.n2.68x32x45
+
+
+N2
+|image:images/master.png["An Elastic Cloud Architecture"]
+| aws.es.master.c6gd
+
+
+c6gd
+|
+azure.es.master.fsv2
+
+
+f32sv2
+|
+gcp.es.master.n2.68x32x45
+
+
+N2
+|image:images/kibana.png["An Elastic Cloud Architecture"]
+| aws.kibana.c6gd
+
+
+c6gd
+|
+azure.kibana.fsv2
+
+
+f32sv2
+|
+gcp.kibana.n2.68x32x45
+
+
+N2|
+|===
+
+[discrete]
+[[cloud-hot-frozen-considerations]]
+=== Important considerations
+
+The following are important considerations for this architecture:
+
+* Frozen tiers are read-only. Once data rolls over to the frozen tier, documents can no longer be updated. If you need to update documents for some part of the data lifecycle, you will need either:
+** A larger https://www.elastic.co/guide/en/elasticsearch/reference/current/data-tiers.html#hot-tier[hot tier], or 
+
+** A https://www.elastic.co/guide/en/elasticsearch/reference/current/data-tiers.html#warm-tier[warm tier] to cover the time period needed for document updates.
+
+* This architecture uses a Hot/Frozen architecture. If you require https://www.elastic.co/guide/en/security/current/about-rules.html[detection rule lookback] or complex dashboards you may need to leverage a https://www.elastic.co/guide/en/elasticsearch/reference/current/data-tiers.html#cold-tier[cold tier].
+
+[discrete]
+[[cloud-architecture-limitations]]
+=== Limitations of this architecture
+* This architecture is not intended for Disaster Recovery, because it is deployed across Availability Zones in a single cloud region. To make this architecture disaster proof, add a second deployment in another cloud region. Learn more at, https://www.elastic.co/guide/en/elasticsearch/reference/current/xpack-ccr.html#ccr-disaster-recovery[disaster recovery].
+
+[discrete]
+[[cloud-hot-frozen-resources]]
+=== Resources and references