Since we already know you can put a more or less adequate elasticsearch cluster on DO for $60 per month, I don’t think that argument holds a lot of water.

By the time you want centralized logs, you are probably already spending much more than the logging will cost on infrastructure.

ES cluster might be easy to install but doing all other chores with your log, along with learning ES search language and quirks is far from trivial. I personally spent months making viable solution on premise and its not something I want to do again. Way less hassle to access server directly for daily logs and just move them during the night on some archival storage.

Nobody said "you should never log into the machine!" We just said reading log files shouldn't require SSH access.

What you're doing here is constructing a straw man argument while agreeing with the same point I was making.

Hold up, never log into the machine is exactly what the discussion is about, not logging into machines for log access being one aspect of it.

I'm guessing you skim read most of the replies after the OP? The OP did touch upon it when describing their own architecture (albeit he wasn't actually suggesting that should be how everyone operates) but everything after that has been more narrowly focused. This particular branch of the discussion was specifically discussing log access:

> > ship log events out of the box and into something searchable, indexable, and can derive metrics

> That's just a way to spend a ton of money. There's really not a reason to ship or index logs...

They're explicitly talking about not logging into machines for log access. One of the ways to make it seem a reasonable suggestion is the broader topic of not logging into machines at all, ever, and why that may be a good thing.

> They're explicitly talking about not logging into machines for log access.

That's what I said. ;)

> One of the ways to make it seem a reasonable suggestion is the broader topic of not logging into machines at all, ever, and why that may be a good thing.

Except none of that was being discussed. Only log access.

The conversation involves both.

No it doesn't. By your own admission:

> They're explicitly talking about not logging into machines for log access.

Why can't you just admit that you didn't read the thread properly rather than insulting all of our intelligence with these piss poor mental gymnastics where you redefine the context of what people had very clearly written.

Because I read the thread? How many times do you want me to repeat myself? They're talking about the specific case of not logging in for log access, but that is partially justified by the wider desire to never have people log in at all. You can separate them but the original conversation didn't.

> You can separate them but the original conversation didn't.

The conversation you're replying to, however, did. I know this for a fact because I was involved in that conversation and I made that distinction myself ;)