and out of your experience the 500mb/day limit in how many devices sending data would that translate too? Roughly
Depends on your level of logging offcourse.
In my case, I have flows coming in from 1 (home) Mikrotik and through the excellent script from Jotne (and I'm logging almost all firewall rules, not only drops) and I also ingress Netflow v5 data
from the same Mikrotik.
At the moment I am at :
Licensed daily volume 500 MB
Volume used today 17 MB (3.428% of quota)
In terms of events, I have about
mikrotik => 55,895,439 entries in de db
stream:netflow => 21,824,448 entries in the db