Support: Model for Ollama only CPU

[maxdal89]

Good evening everyone,
which models would you recommend to run on Ollama locally using only the CPU?

Can I use a single model, or would it be better to use something more specific for each individual module (nl2q, llm_summarize, llm_synthesize)?

For the log_analyzer module, can I use Ollama? I usually get the error: An unexpected error occurred during Log

Analyzer execution: 'Ollama' object has no attribute 'SUPPORTS_STREAMING'."

[jkppr]

I've converted this into a discussion, given its more a general ask.

which models would you recommend to run on Ollama locally using only the CPU?

For the event summarization I had the best results with the gemma3 or llama3.2 models so far. Not as good as with AI studio gemini flash 2.0 though.

For the log_analyzer module, can I use Ollama?

No, this is not supported. The log_analyzer module requires a dedicated Log Analysis Agent. You can find more context about this here: https://timesketch.org/developers/log-analyzer-agent/
TL;DR: You need a service that takes all events as input stream and returns questions, conclusions and event references in a structured format stream. In theory you could build a service that utilizes ollama for this, but this is out of scope for support here.