1. the log aggregator doesn't exactly support DNS lookups
2. You have to parse the log first, exactly precisely where the IP part, then do a proper lookup. But sometimes the log is just a mess.
3. where the log aggregator located cannot do host lookup because of different network and different DNS server.
So overall the lookup would better be done locally.