Your first post had:
Now, thats a black box to me, but someone somewhere has created that integration. How it works, what it really does, what the end result looks like is not given. But the implication is that it's "good enough", right ?
If I were you, knowing what I know now, I'd not try to re-invent the wheel and use what I understand is a supported (by your MSP) working setup. I don't see great advantage of say developing/testing/supporting something with an Agent or other tool to do same job as the one you already have. If the only fear is "Logstash might be retired in X months/years", then for me that risk does not outweigh the advantages.
btw there was a thread long ago on postfix logs and correlating on queueID, and this blog entry covers much the same territory.