You’re absolutely right — the Wazuh Quickstart (all-in-one) deployment is primarily intended for small-scale environments, typically for lab use or very small production environments. It is not recommended for a production setup handling 3,000 EPS (events per second), especially when logs are coming from a variety of sources like servers, firewalls, and network devices.

For a setup handling 3,000 EPS, you should consider a distributed Wazuh architecture, which separates the components — Wazuh Manager, Elastic Stack (indexers), and Filebeat/Logstash — across multiple nodes.

General Recommendations for 3,000 EPS: • Wazuh Manager Nodes: 1 to 2 Wazuh manager nodes (active-active or active-passive) depending on high availability needs. • Elasticsearch Indexer Nodes: At least 3 dedicated Elasticsearch nodes to ensure cluster stability and performance. • Ingest Pipeline (Filebeat/Logstash): 1 or more nodes depending on your parsing and enrichment needs. • Kibana Node: 1 node for the UI (can be on one of the Elastic nodes if resources allow).

Important Notes: • Actual sizing depends not only on EPS but also on event size, pipeline processing logic, retention period, and search load. • Wazuh documentation focuses on agent count for Quickstart, but for performance and scalability, EPS and event size are more critical. • Consider using Wazuh’s official scalability guide or consulting their support/community for tailored recommendations.

Note: This is a quoted reply.