how do you handle log aggregation for microservices

were moving towards more microservices and the sheer volume of logs is becoming a pain. right now, each service logs to its own file, and we ssh in to check. not sustainable. thinking about setting up a central log aggregation system like ELK or Splunk. how are you guys managing logs in a microservice architecture? any pitfalls with centralized logging i should watch out for?