logging is one of those things that gets complex in a hurry. if i was starting a log processing company i'd also do this, since pure bytes isn't a good metric. A really long error chain (like java gives) is "one error", but is that stored as a single "error" or multiple lines and parsed out later?
I really stopped paying attention to logging around logstash era for enterprise solutions, so my knowledge is woefully out of date, but based on how crazy my python services logfiles get for a single instance, i don't know that much has really changed.
https://lightrun.com/pricing