Receiver Node as collector

[capitangiaco]

Hi all
I am using a distributed deployment for Security Onion with Manager, Search, Forward, Receiver and IDH nodes.
I am actually sending netflow/slow and syslogs to the Receiver node, cause it seems to be the node with lower cpu usage (from grid tab).
Is It this correct or should I add another Forward node dedicated to netflow/syslog collection ?
At the moment I have about 200 Elastic Agents on the Fleet server, but at the end they will be about 500.
thanks
Giacomo

[InfosecGoon]

Assuming that you're using the Elastic Agent integration to receive those netflow and syslog logs, you can send them to any machine running an Agent in your environment. It doesn't even have to be one of the Security Onion nodes, you could just spin up a fresh Linux VM, install the Elastic Agent from the Downloads section, and assign an Agent Policy with the appropriate integrations enabled.