How to organize the collection of logs on the highload?

Question

RSYSLOG

We tried this scheme:
app->rsyslog->filebeat---[tls network]--->logstash->graylog->elasticsearch
Load up to about 50 million messages per day. Logstash is dead.
I think to make it so that kibana and graylog would not write anything to the elastic, ideally, but only visualize the data.
Does it make sense to start logstash locally on hosts and write to it directly from rsyslog via json template. And would logstash'y put everything in elastic? (similar to this approach )
I would like to hear the opinions of professionals, how do you manage logging?

Answer 1

Maybe it will help: Yury Nasretdinov, "Collecting logs in the "cloud" in Badoo"

Answer 2

experiment,
aggregate
Clickhouse to help, Sphinxsearch to help (however, after the clickhouse with its %find% is no longer strong), GoogleBigData to help
, of course, there is a loss in the network: consolation - sampling to help, or selective logging