For example they recommend that you have at least three ES-nodes installed. I have only 1 node and when I do not log the complete firewall