I use SumoLogic, but have used Splunk and ES before. Nice thing is they have a free tier that you can ingest 500mb/day of logs, downside is its only 7 days of retention, but for most of my needs I don't really have much usage beyond troubleshooting.