Splunk

We are currently exploring Elasticsearch and Splunk for our centralized logging solution. I need some feedback about these two tools. We expect our logs in the range of upwards > of 10TB of logging data.

I am using Splunk, but trying to change to an open-source software; what I need is something that reads in "real-time" an archive, it's not exactly a log, it's actually data itself (there is a lot of data, by the way), stores this data/log for a long time (more than 2 years), has a pretty easy way to search the data read (so some search language where I can search by IP for example), and a way to connect to the software, where I can search by API.

I am designing a Django application for my organization which will be used as an internal tool. The infra team said that I will not be having SSH access to the production server and I will have to log all my backend application messages to Splunk. I have no knowledge of Splunk so the following are the approaches I am considering: Approach 1: Create an hourly cron job that uploads the server log file to some Splunk storage for later analysis. - Is this possible? Approach 2: Is it possible just to stream the logs to some splunk endpoint? (If yes, I feel network usage and communication overhead will be a pain-point for my application)

Is there any better or standard approach? Thanks in advance.