This is excellent, thanks for sharing.

What do you use to ship the logs into ES? I'm not familiar with the technologies you're using, but is this in-sourced developed tools? Or, are there OS options for log aggregating in ES that you would recommend?