[lycidas]

For cost, stackdriver works the best. Idk if they have a custom agent but Fluentd works great to ship logs to your platform of choice.

AWS cloudwatch is also good for cost but has much slower query speeds (the slowness makes me think it's not Lucene based?).

If you could splurge on hosted services, my favorite logging goes to datadog and it has all the other bits of observability built in for down the road.

https://landscape.cncf.io/ is usually my go-to if you wanna find best-in-class solutions to host yourself.