We have several teams pushing logs into a shared Logstash, over RMQ. Depending on the amount of logs you have, I would suggest you have a separate RMQ cluster for the logs. That said RMQ is a great buffer for logs, incase there is an issue with logstash / es at the far end.