We generally run them through central syslog servers or directly to a logstash tcp or udp input. One way or another all logs from around the world end up in an

We generally run them through central syslog servers or directly to a logstash tcp or udp input. One way or another all logs from around the world end up in an elasticsearch cluster where we either query for things manually or use kibana to interact with them. Works pretty well actually.