still log aggregation and querying, but at 1/webscale. because I have the tinest of clusters but I still want to be able to do some log magic in it