If you can already subset the logs by date and component, scanning the few thousands entries of interest is probably cheaper than maintaining indexes on many fi

If you can already subset the logs by date and component, scanning the few thousands entries of interest is probably cheaper than maintaining indexes on many fields for all kind of imagined queries. The average-case algorithmic complexity doesn't matter if you can keep N low, even if you run the algorithm a lot.