A useful default for this problem is a standards-based log pipeline with structured JSON at the application boundary, an OpenTelemetry Collector or equivalent relay, and a backend chosen for the query shape your operators will actually run. For a logistics experiment, keep tenant, cohort, route, and cost dimensions in every event. A backend that searches text quickly but drops those dimensions will produce a confident-looking, unusable answer.

That distinction matters.

Choose this shape Pick it when Main trade-off for cohort cost attribution

Log search engine Operators need flexible field and full-text investigation across irregular events Query freedom comes with schema and retention discipline

Label-oriented log store The workload is mostly time-window filtering over a small, stable set of dimensions High-cardinality tenant or parcel labels can make the model a poor fit

Columnar analytics store The team runs repeated aggregations over large event sets and can manage a data model Fast analytical scans…