Building a Centralized Logging Infrastructure

For small deployments, you might be surprised how far you can get with just systemd/journalctl. It even has built in aggregation over a network.

"joecool" and "gentlemanjerry" lol

Good article. My teams frequently had problems with logstash. It's harder to do logging than you'd think.

Logstash is terrible, i've had so many problems with it.

what do you prefer?

With logstash I had cases where it was taking more resources than the application that generated the damn logs.

These days i prefer fluentd, but in some cases I let my apps insert directly into ElasticSearch.

at aptible - we prefer fluentd. one of our engs talks about the reasons why in the article above, but the tldr is fluentd is extensible like logstash, but far better performance

Splunk?

If you're a trillionaire then sure, absolutely :D Splunk is a great tool but oh boy is it ever expensive!