Logs, like any other data, are subject to extract-transform-load especially for deriving properties and annotations that serve to augment the information associated with the logs and facilitate search. The log channels are independent and can be numerous. Since each channel can be viewed as a datastream, it is also possible to customize log searches to be over streams rather than time-series buckets.
In fact, if the logs are being generated with the use of a storage product, then storage for logs can be earmarked in the same product as one of the sinks for the logs. This reservation is only for introspection on the operations of the product. The persistence plays a major factor in doing away with the need for external systems. It also helps with dogfooding the product. This is essential because ongoing operations continuously produce more logs and the more the data, the better the use of storage product.
The storage product is a sink for the log streams. It is also not the only sink. The use of log appender help with registering other sinks and transferring the data to the sink. The use of more than one sinks helps with the publication of the data to different usages. Some of the usages might involve notifications.