@ramsey @rasmus I worked a few years with logging on legacy systems. My approach was writing into rotating files (some were minutely with max 10 files because of the stream size). Filebeat streaming to logstash parsing to elastic (all in private network on VMs). The only problems I had to face was managing the free space. I used the rotating logs on FS as a broker. I don’t really know the impact of file logging as I did, but this was negligible in comparison with all the legacy bad designs.