The ability to easily add new components, such as logging agents, filters etc., without having to make changes in the codebase is very useful for quickly prototyping an application with lots of different use cases. Also since we are using the agentless version it's easy to create our own agents - this reduces some of the risk that comes from relying heavily on third party products. As mentioned above, adding custom logic can be done by writing scripts in Java or Python which is then executed at runtime when needed. One drawback I found was sometimes you need to wait until after your cluster has been scaled up before those logs start showing up so if you have a large number of systems this could cause issues. If you're looking for something flexible, easy to customize and quick way to build out prototypes there isn't much else available like this. Using the scriptable versions allows us to prototype applications really quickly with the minimal.