Every on-call engineer has lost an evening to some version of this. Something breaks; the fix is usually somewhere in the logs, and the logs are scattered everywhere: a dozen servers, a few containers, a couple of cloud services, none of them in one place. So, you SSH into one box, grep, get nothing, move to the next, and an hour later there are fifteen terminal tabs open and still no clear sequence of events. Log aggregation tools kill that scramble.