storage advice zfs

Hello,

I have a ssd pool with 2 ssd for docker and vms.

This pool holds also my nextcloud data.

I want to install one (even several as i will configure a distributed setup) vm for security onion.

I have room for a basic vm but security onion is quite storage hungry.

Inside this vm the storage space is managed with lvm; and there is mainly 2 partititions "/" and "/nsm"

What i plan to do is to allocate space for creating the vm on the ssd mirror pool and a second space which i'll mount to "/nsm" partition.

For that second space i need to add a pool. I'm a newcomer to zfs but want to try it.

I'll dedicate a small sas das i have (8bays). And to populate that das i have 6 sas hdd and 2 sas ssd. All professionnal grade.

Considering the main use of that pool will be to be mounted in the vm as /nsm partition; and that partition holds pcap files, zeek files and elastic search files, i'm looking for the best layout possible given the hardware i have.

For that particular usage ram is not a problem (i have 200G free fro now). i should not need l2arc.

At first i was thinking about a raidz2 pool with 6 hdd (4Tb per unit) and a mirror of 2 ssd (800G per unit) as special vdev for small files and metadata.

I'd like to know if there are better options.