Cheap centralized logging for a small SaaS should start with a strict event schema and a useful retention window, not with a pile of agents. The practical target is evidence: enough correlated events to reconstruct a customer incident across a Node.js web process, Docker, and cron jobs without drowning the search index in debug noise.

Short answer: emit one JSON object per event to stdout, collect every container and cron stream in one searchable store, and make requestId , job , customerId (or a non-sensitive surrogate), status , and durationMs first-class fields. Keep the event vocabulary small. Sample success noise, retain failures longer, and test the fields you need before paying for more volume.

The event contract comes before the search tool

A log line is evidence only if another engineer can join it to the rest of the incident. A timestamp and message are not enough for an order problem. The event needs a stable action, outcome, actor boundary, and correlation key.…