Suggest to try syslog-ng. Have a syslog-ng running locally on all your hosts and forwarding logs to a central one. Applications can easily send logs to syslog,

Suggest to try syslog-ng. Have a syslog-ng running locally on all your hosts and forwarding logs to a central one. Applications can easily send logs to syslog, all languages/loggers support it. The central syslog can listen for remote logs and save everything into /storage/hostname/year-month-date/file.log for example. This allows you to grep everything from that host. It's simple and it uses very little resources.