Agent/Collection process running on each host
Written in Java
Tails all service log files
Parses logs using Grok/regex. Can merge multiple line logs, e.g. stack trace
On restart, can resume from last read line. Uses checkpoint files to maintain state
Extendable design to send logs to multiple destination type.
Currently can send logs to Solr and Kafka