I agree, If you are aggregating logs so small that they can fit into memory, most likely that you do not care where it goes. Otoh if the logs are enormous you m

I agree, If you are aggregating logs so small that they can fit into memory, most likely that you do not care where it goes. Otoh if the logs are enormous you must have robust periodic log aggregation jobs like map reduce to do that and it is must to have logs on disk. Moreover 50m/day is ~ 578/sec , which isn't huge for a cluster of servers.