How would you design an Elasticsearch cluster to handle 1 million log events per second with 30-day retention?

# Data stream template
PUT _index_template/logs-template
{
  "index_patterns": ["logs-*"],
  "data_stream": {},
  "template": {
    "settings": {
      "number_of_shards": 20,
      "number_of_replicas": 1,
      "index.refresh_interval": "30s",
      "index.translog.durability": "async",
      "index.translog.sync_interval": "5s",
      "index.lifecycle.name": "logs-tiered"
    },
    "mappings": {
      "properties": {
        "@timestamp": { "type": "date" },
        "message": { "type": "text" },
        "level": { "type": "keyword" },
        "service": { "type": "keyword" }
      }
    }
  }
}

# Bulk insert optimization
curl -XPOST 'es:9200/logs/_bulk' -H 'Content-Type: application/x-ndjson' --data-binary @bulk.ndjson