How does centralized logging change incident response compared to relying on `docker logs` per host?

With centralized logging, an engineer can query across all replicas and all hosts for a given time window, request ID, or error pattern in one place, which is essential when a service has multiple replicas (the relevant log line could be on any of them) or when the affected container has already been restarted/removed (its `docker logs` history is gone with it). Relying on per-host `docker logs` requires knowing which host to SSH into, doesn't survive container removal, and doesn't scale past a handful of instances — it works for local development but is operationally unworkable in production.