Well, we use Elasticsearch extensively for our applications and have developed our internal best practices for running it. A single instance is not recommended

Well, we use Elasticsearch extensively for our applications and have developed our internal best practices for running it. A single instance is not recommended for ES. If you're totally fine with losing logs, I guess it's okay, but logs are a critical part of production infra for us and so we would either run a larger cluster with data-only and master-only nodes for optimum reliability.