Apache logs to go rsyslog via logger (apparently the best option with Apache 2.4). Syslogs go to a central rsyslog server over RELP (which mostly has been reliable, but a recent bug in rsyslog daily caused us to have to reload a week's worth of logs).
Central rsyslog server uses mmnormalize/liblognorm to parse the apache logs and load them into Elasticsearch.
haproxy logs directly to rsyslog via a domain socket, RELP to central server, lognorm to load into ES.
ELB logs go into S3, and logstash pulls them down and loads them into ES.
The remainder of syslog messages just go into files on the central server.
We also have Sentry set up with some newer applications logging into that.
Central rsyslog server uses mmnormalize/liblognorm to parse the apache logs and load them into Elasticsearch.
haproxy logs directly to rsyslog via a domain socket, RELP to central server, lognorm to load into ES.
ELB logs go into S3, and logstash pulls them down and loads them into ES.
The remainder of syslog messages just go into files on the central server.
We also have Sentry set up with some newer applications logging into that.