I built a dashboard pulling SRX logs into Grafana. Works way better than STRM.

STRM's pricing for log ingestion is inefficient for a stable firewall log stream. Built a custom pipeline for 73% lower cost.

Components:
* SRX configured to export structured log data via syslog (RFC 5424) to a collector.
* Fluent Bit on a small instance parses and forwards to VictoriaMetrics.
* Grafana dashboards query VictoriaMetrics.

Key Fluent Bit parser for SRX traffic logs:
```
[PARSER]
Name srx_traffic
Format regex
Regex ^<(?[0-9]+)>(?[^ ]+) (?[^ ]+) (?[^ ]+) (?.+)$
Decode_Field_Key escaped
```
A second parser extracts the key-value pairs from the `msg` field.

Results:
* Ingestion cost: ~$12/month for ~15 GB of logs.
* Latency from event to dashboard: under 10 seconds.
* Can now graph source/destination ASN, policy hits, threat logs, and session counts on a single pane.

STRM would charge ~$45/month for the same volume. The VM and compute costs are minimal because the data stream is consistent, not spiky.