With logstash I had cases where it was taking more resources than the application that generated the damn logs.

These days i prefer fluentd, but in some cases I let my apps insert directly into ElasticSearch.