Never heard of Elastalert, I'll have to check that out. By the name I'm guessing it's triggers off an elasticsearch server, which would cover infrastructure I already have - so that's nice.

Thanks for the suggestion!