I wonder if the SQL hold the insert traffic, because if it did... I would guess one could argue file->logstash->redis->ES would be overarchitecting it :)