Any chance you all would be open to a beats server as a filebeat input option?
My team currently run a series of beats servers at my edge to push into a larger aggregator infrastructure(over tcp and udp), and would love to not run logstash on that same infrastructure in order to receive data from winlogbeat/packetbeat/other filebeat instances.
We've found that filebeat is able to handle this load a bit more safely than logstash.