Just to walk you through a simple example
Scenario1: 10 switches send Syslog directly to LEM's inbuilt Syslog server = LEM will use 10 node licenses
Scenario2: 10 switches send Syslog to a Kiwi Syslog server. LEM Agent reads these logs from Kiwi Syslog Server, and sends the normalized events to LEM. This will consume 11 node licenses. 1 for the LEM Agent on the Kiwi Syslog Server, 10 for the switches.
So, the only difference between sending logs directly to LEM vs a detached Syslog server is 1 node license per Syslog server.