We're trying to make sure we understand the question here -
* Component logs do not go through loggregator today, only to the rsyslog endpoint designated.
* All app logs would be available to an operator via the firehose.
* " it is more like pulling model from end component side so if components before it are slow in sending logs then there will be buffers" - component logs again are not part of the firehose - even then, there would be buffers, but all messages are timestamped (if you're worried about ordering?)
* "is there a need to implement something in between doppler and traffic controller to push all the application logs " - not sure I understand, but though you need at least dopper in every AZ that a metron is in today, doppler can speak to traffic controllers cross-AZ.
Did that help?