Yes, for years in multiple companies. I greatly prefer it over Splunk or self rolled ELK crap. If you reformat all your logs to output as json you can "| json

Yes, for years in multiple companies. I greatly prefer it over Splunk or self rolled ELK crap. If you reformat all your logs to output as json you can "| json auto nodrop" and suddenly you have fantastic statistics off every single field. It's also smart enough to figure out 'close enough' json, like if you're piping log output to syslog which adds it's own metadata. Their Logreduce feature is also nice for "Ingestion suddenly shot up but eyeballing doesn't show a pattern, help me out here!" Hit the button and get logs grouped by 'these are pretty close except for x." Amusingly they called me once. I apparently managed to craft a scheduled query that was causing their systems issues. I okayed them adjusting the query to something a little less aggressive. The only feature that seems wonky is 'real time' (which they limit you on how many you can use). Never was a big issue, I generally would run 'real time' stuff every 15 minutes. I will be very sad if they die or get bought out by Splunk. It's a great product.