I've been extremely unimpressed with logstash - many of the plugins in the standard repo are poorly maintained; certain plugins misbehaving - can kill the entire logstash process; it's really inexcusably bad for such core-infrastructure software tbh.