Most of the time you’ll want to use the ELK stack to process your logs from a separate server. Previously we used a tool called the logstash forwarder, however it’s now called filebeat instead.
It makes sense to offload your log processing CPU work to another server so that it won’t interfere with the operation of your main site. Using cloud hosting such as digital ocean or AWS, you’ll easily be able to scale up or down your cloud hosting needs keeping cost to a minimum.
Naturally, you’ll need to pipeline the logs from your live server to your log processing ELK stack instance. For that, you’ll want to use the Logstash forwarder (filebeat).