The challenge
Security operations centres are buried in log data. In OT environments with thousands of endpoints generating syslog at high rates, the volume compounds fast: the more devices you monitor, the more your SIEM costs to run, store, and process. The obvious fix is to filter and pre-process logs at the edge, before they reach the SIEM, but the industry-standard tool for that, Logstash, is too heavy for edge gateways, remote OT sites, and resource-constrained appliances.
Trout built Impeller, the edge log processing engine inside Access Gate, to do that work in a fraction of the footprint. The question was whether an independent lab would confirm it under controlled conditions.
The assessment
HUN-REN SZTAKI (Institute for Computer Science and Control), through its Department of Network Security and Internet Technologies, ran an independent performance assessment as part of the EU-funded SOCCER Project (Grant Agreement #101127847). The report was published in January 2026.
The lab built a realistic distributed pipeline using Docker containers orchestrated via Docker Compose, then ran Impeller head to head against Logstash across eight test scenarios. Each scenario varied three parameters: operation mode (forward-all versus parsing and filtering), load volume (5,000 events per second up to 25,000 events at 2,000 per second), and resource allocation (from 0.5 CPU core and 500 MB RAM up to 4 cores and 4 GB RAM). JVM warm-up and pipeline flush phases were included so the measurements reflected steady-state behaviour.
Results
Impeller used fewer resources than Logstash in all eight scenarios. Its image is 91% smaller (80 MB versus 890 MB), which is what makes it deployable in edge and OT environments where storage is limited. It started in 2 seconds against Logstash's 8 to 39, and consumed 3 to 13 times less CPU per event, at 0.06 to 0.13 ms versus 0.43 to 1.73 ms.
In practice that means lower infrastructure costs and less load on the systems being monitored, so a single noisy device cannot take down the log pipeline. For the full methodology, all eight scenarios, and deployment recommendations, see the Impeller validation report.