therealkay

What people often forget is that cross-AZ traffic is included in those .elasticsearch instance prices. In a 3-AZ deployment and given the frequent rebalancing/replication traffic that is a significant line item if you run it yourself. I'm not arguing it's not expensive, but when you look at the TCO it's less obscene than if you just look at EC2 pricing alone.

You could also take a look at Graylog (https://www.graylog.org/), it supports structured data in a variety of formats and can send alerts as well.

It's similar in spirit to elasticsearch + logstash + kibana, but more integrated.

Disclaimer: I work on it, so I'm not going say what's better, just giving another pointer.