What’s “cached” referring to here, in the case of the get?

We keep recently fetched files on the EC2 instance's EBS volume for a few days (or until they are evicted to make space), as this is faster than re-reading them from S3 each time someone does a search, and it's common to do a number of searches over the same time period when debugging an issue.

How does this work if the dev's want to do live debugging etc.

We don't handle that case in our S3 upload system. We only upload upon rotation, which adds a latency of around a day (less for very noisy log files). For live debugging, we either replicate the problem in local environment (if possible), or the dev logs into the production server and runs `tail` on the log file.