Our syslog to graylog2 bus - really, no system could help up to our log stream data. On some systems we have way more than 500GB/day so a different approach was needed