I've been spending some time looking at how to get data into my ELK stack, and one of the least disruptive options is Elastic's own Filebeat [https://www.elastic.co/products/beats/filebeat] log shipper. It's one of the easiest ways to upgrade applications