Dear,
Have you seen the contribution "How Sophos modernizes data management with Cribl"? I think this might be interesting for you.
Best regards,