just to let you know that migrating from NXLOG ingestion of dns.log and dhcp.log for a Windows environment to a Packetbeat agent managing DNS and DHCP ports, I achieved a massive 1GB / day space occupation reduction.
I find it unbelievable…did you ever experimented something like this?