Some people find EFK (Elasticsearch Fluentd Kibana) to be another compelling alternative to Splunk (Disclaimer: I am one of the maintainers of Fluentd)
http://docs.fluentd.org/articles/free-alternative-to-splunk-...
http://docs.fluentd.org/articles/free-alternative-to-splunk-...
1. Easier to extend that syslog-ng if you have a modest knowledge of Ruby
2. Easy to configure file- and memory- based buffering and failover.
3. Advanced filtering out of the box.
4. Rich plugin ecosystem with 300+ plugins.
At least that's what I've heard from the users who switched from syslog-ng to Fluentd. I am happy to learn more about what makes syslog-ng great since I've never used it seriously myself =)