That sucks. I was looking at implementing Graylog but Elastic Search, or any other cloud datastore, is out of the question. We need to keep the logs in the same data centre as the servers for reasons of confidentiality, and for performance reasons as well. Most of the logs will never be used for anything. We log lots of stuff just in case, and after a few weeks there is no real use for them. If we wanted stats we would calculate them and then delete the logs. We certainly don't want to consume huge amounts of bandwidth shipping logs across the Internet.

At this point I'll probably just use an older version so that we have local storage and local search.