We solve this by using Filebeat on all our RKE2 clusters.
Filebeat runs on all cluster as a demonset, then pipes all logs from the nodes to ELK for processing.
This allows us to choose our own log retention.
I'm sure you could do a similar method for your cluster running Rancher.