i was wondering whether we can use logstash or any other opn source or free Log management too to collect,index the data and then feed this index into RSA envision or any other enterprise SIEM tool. Will this be beneficial in any way? Also are the indexes of various Log Management and SIEM tools -- splunk,RSA envision,HP Arcsight Logger and Logstash etc compatiable with each other. My organization is planning to buy RSA envision appliance and is there any way to restrict or select only certian type of log files eg: security logs or apache logs .. so that onlt those are monitored and this will reduce the EPS(events per second).