Logs flow: application → local file → shipper → queue → processor → storage. Shipper (Filebeat, Fluentd) tails log files, batches, sends to queue.
Kafka buffers bursts, decouples producers from consumers. Partitioning by service or host for parallelism. Back-pressure: if storage slow, queue absorbs. Consider sampling high-volume debug logs to reduce cost.