Efficient log aggregation strategy for ephemeral containers

With spot instances and autoscaling, our container lifetimes are measured in minutes. Fluentd sidecars add overhead, and shipping logs to S3 then querying with Athena has a 5-10 minute delay. Need something closer to real-time for incident response without breaking the budget on log volume.