Thinking further, I guess I'm conflating logging for devops and logging for analytics and logging for audit trails.
Not sure how to separate it out without data duplication (the boundaries aren't clear cut?) and for a small system it prob doesn't matter - I'm nowhere near Netflix, PayPal et al for scale.
A good rule of thumb is that if you can send all your logs to one place and tail -f is still a reasonable way to consume them, just send them all to one place.
Not sure how to separate it out without data duplication (the boundaries aren't clear cut?) and for a small system it prob doesn't matter - I'm nowhere near Netflix, PayPal et al for scale.