Centralized Log management for user tracking across several servers & applications.

We need to setup a centralized Log management for user tracking across several servers & applications. In order to be able to able to track users activities & path across servers and sub-applications. Server operating system: ONLY Linux, Only Debian 7 & 8 9 servers Ideally we need the most lightweight solution (CPU & memory usage ) on monitored servers - again, it must be as low as possible. We don't care about latency (we don't need realtime), because it is only for forensic reseach (research after any incident by the support team). So preferably we need the least network bandwidth usage as well, FYI local storage is no problem for bufferization (could be gigabytes). I personnaly prefer very basic solution like syslog-ng. Or rsyslog. Or nxlog. Or filebeat. Please find attached a sample log file to be analyzed/processed by syslog-ng, or rsyslog, or filebeat, or fluentd, or anything we are open to options. on every application log there is a key like this: [24418549=Laetitia resoludor] => this is the tracking key of a user. If required, we are open to update/change our log format (I've been told that json format for log is faster) for better processing. FYI, we will also need a search interface that allows looking for a user id (the above key) & be able to follow what he did. Like a trail. We don't need any fancy dashboard, we don't care. Filebeat is a good option instead of syslog-ng, We are open to look at Graylog, Or a classical ELK Stack for displaying logs we are open to other options.