Real-time streaming is necessary for operational alerting because it delivers logs in seconds, allowing you to catch cache misconfigurations or origin failures before users report them. Batch export is easier to set up but introduces a lag of several minutes to an hour, making it better suited for long-term trend analysis rather than incident response.