Comment by aftbit

At our company, we use logrotate to put all logs into an S3 bucket by hostname (with a PutObject only key of course). We then have a service running in EC2 that does a cached get of those logs (based on hostname and timestamp range) then runs ripgrep over it and returns the lines that match.

It works well and requires very little maintenance, and it costs a tiny fraction of something more full-featured like Papertrail, NewRelic, etc.