What do you use for human consumption of those logs? I imagine not everyone internally will be querying ES directly but you have some UI in front of it? Did you implement this part yourself or using anything off-the-shelf?

The DD tradeoff is a capricious one. Hats off to running a tight ship since your DD bill would let you know if you let complexity get the better of your stack (;