Currently centrallog outputs syslogs from all hosts into a common set of flat files. These files become large, and searching through them for something specific can be time consuming.
To help with this, let's split syslogs off into hostname directories like this:
Along with that, let's update logrotate to rotate and compress files in the hostname directory so they are easier/faster to find in the future. like this:
Along with this we'll need to update mtail to look at the new log paths, and automate cleanup of hosts as they leave the fleet.