@Tuhin if you're aws-centric, https://github.com/OktaSecurityLabs/sgt is built entirely on aws and defaults to using kinesis firehose for logging, which in turn splits to s3/elasticsearch