That is an interesting suggestion. In a prior task, I had some experience using beats->ES, which is why I was shooting for beats->OpenSearch. I was somewhat familiar with Fluentd being a potential replacement for logstash, but I am not too familiar with how fluentd would replace a beats, to be honest. I am trying to get another instance setup on a new project using opensearch from scratch (currently stuck Using PKI certificate for kibanaserver user: 'Tenant global_tenant is not allowed for this user' here, but hopefully someone has a suggestion on that one soon - it is a low-burn background project at work here right now). The initial plan was going to be beats->OpenSearch since they are all yum/dnf automatically updated (manually installed things are a royal pain / expensive to monitor for so we do everything we can to stick with a yum/dnf supported stack if we can at all). I will have to search for how fluentd can replace beats and get back with you, unless you have some pointers/links you can share.