I went for kiss and very very low resources: All my logs go to one central syslog. That takes in the logs, filters out crap, send critical messages to IRC and writes logs to postgres. Then grafana queries the postgresdb