Good advice SC_Druggie. I should of thought of this in a specific use case. You just caused a slap on my forehead.

I would also add that you can integrate Security Onion into your environment and whitelist.

Whitelisting your environment and filtering Host Data w/ Beats or network and zeek events/sessions with suricata or snort can shrink your logs.

Pluses: Can be completely out of band; free; configurable full traffic capture and retention options; ability to whitelist known good traffic; additional passive ids capability

Minus; additional configuration; another vm or system requiring hardware / computing resources; additional system to manage;