By count, most installs will be the large cloud providers

Agreed. And in my experience , most large cloud providers’ Linux systems I’ve worked on (either their VMs as a tenant or their underlying hardware as an employee) log locally and ship additionally.

We did a small amount of system logs, but anything high volume went directly remote