There are specific service maturity guidelines that require each component to have their logs transferred from

component -> log shipper -> log transformer -> search engine

Instructions are available in the ADP docs