We use the heck out of GrayLog2. We have a dual datacenter setup with multiple elastic search instances. A coworker of mine did a fantastic job writing up our setup:

http://secopsmonkey.com/migrating-graylog2-servers.html http://secopsmonkey.com/migrating-graylog2-servers-part-2.ht... http://secopsmonkey.com/migrating-graylog2-servers-part-3.ht... http://secopsmonkey.com/migrating-graylog2-servers-part-4.ht... http://secopsmonkey.com/migrating-graylog2-servers-part-5.ht... http://secopsmonkey.com/migrating-graylog2-servers-part-6-le...