You are making assumptions that the log upload system is working in the first place. It's just another moving part in the equation. Since logging normally shou

You are making assumptions that the log upload system is working in the first place. It's just another moving part in the equation. Since logging normally shouldn't affect production traffic latency, you usually want to offload responsibility to a separate process/sidecar/etc. That requires intermediate storage as logs are generated, which can fill up (disk or ram, it's all finite). Since you don't want just any person sending logs for processing, you now have to ensure this separate process is authorized to upload data, which means you probably have another security token in play. The search system must index the data in near real time, which may lag due to data backlogs, service disruptions, etc. It's hard to beat the power of a live log tail when you need it.