You might underestimate the size of deployments of logstash. Mailchimp runs logstash in a pretty sizeable cluster for all traffic coming into HTTP front-ends. I can think of quite a few sizeable logstash installs that I can't mention.