We can argue about exact implementation, but SRE demanding all apps (assuming non-interactive ones run on servers) log to the same channel (with enough tagging info to ID the app/server) is a good thing. In my case we are automagically configured with a Splunk appender for Logback (and the platform also sends the stdout/stderr to Splunk under a different sourceType).