RELP is very much standard syslog wire protocol(which is just plain tcp anyway), but with some extra stuff to avoid losing data. Just fixing tcp issue here, whe

RELP is very much standard syslog wire protocol(which is just plain tcp anyway), but with some extra stuff to avoid losing data. Just fixing tcp issue here, where data could be ACK-ed into OS receive buffer and the app could be killed before offloading into a persisten storage. Not losing data is very important in log shipping. The json that syslog wraps data in is actually using the same syslog protocol - nothing is chaging here. It's encapsulated within the same protocol. The only reason to unwrap json is when you need to start structuring your data for BI views, your milage may vary. The key is that these two are de-coupled. Because you work on a basic level networking / storage layers its very easy to reason and build reliable pipelines according to your needs. As you say — you can't beat that. PS: The pain starts when you need to deal with multiline logs like java stack traces but then you just work with devs to log everything into json. Edit: split comment, more info