The logs generated in cluster are usually saved on persistent volumes which are available between restarts. If the application prefers external only logging, then any internal storage for this purpose can be ephemeral. 

The dependencies on external log services come with downstream benefits such as api monitoring. With the help of logs, specific queries can be run on log indexes for time slice events which can help with determining trends and raise alerts when thresholds are exceeded.  

The queries for the logs change depending on whether they operate over stream or over entities. This does not have to change the user interface that retrieves time-sliced data, the display of the query parameters and the display of the results against the query. The nature of the queries only impacts the query execution over the data. The query and the data are independent of each other so long as one form or other of query can be used to return results of the analysis on the data. 

This leaves the front-end open to display query filters, charts and graphs without any regard for underlying subsystem. Since the logs are a form of data, the user interface for the querying on the logs can be the same as the user-interface for any other data. Furthermore, the parameters for logs will likely be similar between many queries, so the user interface controls and the queries can be appropriately matched. The page that displays the controls will then likely change very little for using against one or more queries.  

Whether the logs are read from an index or from sequential formats of storage does not necessarily change the notion that the execution follows the timeline in the logs for the activities performed by the product which helps reduce the overall cost of maintenance. 

I got my company issued IntelliJ license today