It depends on exactly what you are doing, but, LEM is licensed based on the number of source addresses. I would expect you would need a 60 if you want to collect events from the 10 hosts and each of the 50 containers. You will be able to get a lot of information from the hosts, but if you want to collect something from inside the container, you'll want to account for that. Again, it depends on what logs you are collecting specifically and what is only available inside the container.
↧