I did this with winston at one point too, the reason I didn't change CEF logging over is because of a comment somewhere that said "we want to see CEF logs distinct from normal logs". I like this way more.