We stood up a cluster that is processing over 350,000 events per second, with each event a fixed payload size of 2K. The storage required to process that much data over an hour is beyond what we wanted to pay for at AWS. Additionally, we don't have a requirement to keep the files around for an extended period after processing.
It would be tremendously valuable for us to be able to define the log.retention in minutes, not hours. For example, we would prefer to only keep 30 minutes of logs around.