I have done a POC regarding Log management using ELK Stack.

I have converted pegarule.log to pegarules.JSON.log using JSONAppender in the server itself

I am using pega version 8.6 

In the server we have prlog4j2.xml i have added the given appender below pegarules.log

<RollingRandomAccessFile name="JSONAppender" fileName="${sys:pega.logdir}/PegaRULES.json.log" filePattern="${sys:pega.logdir}/PegaRULES-%d{MM-dd-yyyy}-%i.json.log.gz">
  <LogStashJSONLayoutPega/>
  <Filters>
  <!--Deny message logged under ALERT log level-->
  <ThresholdFilter level="ALERT" onMatch="DENY" onMismatch="NEUTRAL"/>
  </Filters>
  <Policies>
  <TimeBasedTriggeringPolicy />
  <SizeBasedTriggeringPolicy size="250 MB"/>
  </Policies>
  <DefaultRolloverStrategy max="20"/>
  </RollingRandomAccessFile>

 Instead of using Logstash to process the logs i directly converted the logs to JSON (which is more readable) and stored in Elastic search.

Thanks,

Ajay Raghul.S