Use the following steps to estimate the number of shards you need:
Calculate (or estimate) the number of requests per second that your CloudFront distribution receives. You can use the CloudFront usage reports or the CloudFront metrics to help you calculate your requests per second.
Determine the typical size of a single real-time log record. A typical record that includes all available fields is around 1 KB. If you’re not sure what your log record size is, you can enable real-time logs with a low sampling rate (for example, 1%), and then calculate the average record size using monitoring data in Kinesis Data Streams (total number of records divided by total incoming bytes).
Multiply the number of requests per second (from step 1) by the size of a typical real-time log record (from step 2) to determine the amount of data per second that your real-time log configuration is likely to send to the Kinesis data stream.
Using the data per second, calculate the number of shards that you need. A single shard can handle no more than 1 MB per second and 1,000 requests (log records) per second. When calculating the number of shards that you need, we recommend adding up to 25% as a buffer.
For example, assume your distribution receives 10,000 requests per second, and that your real-time log records size is typically 1 KB. This means that your real-time log configuration could generate 10,000,000 bytes (10,000 multiplied by 1,000), or 9.53 MB, per second. In this scenario you would need just 10 Kinesis shards. You should consider creating at least 12 shards to have some buffer.