Your logging pipeline has more components than your application. Beats ships to Logstash, Logstash ships to ES, ES ships to cold storage, and you operate all four. XERJ replaces the pipeline with one ingest endpoint, one storage engine, and one retention number.
[logs] retention_days = 30. Time-partitioned internally so pruning is O(partitions), not O(documents).The playbook walks the full recipe — schema, ingest command, queries, and the dashboard. The playground runs on seeded data; benchmarks were measured against Elasticsearch 8.13 on 2026-04-14.
Send us a 1 GB sample of your production logs (any format — JSON, syslog, OTLP). We'll benchmark ingest throughput and query latency head-to-head and share the scripts.