If your logs have fields, they have a schema. Querying them like a table beats grepping like it is 1999.

A log line with key-value fields is a row. A stream of them is a table. The moment you accept that, a class of slow investigations becomes a fast query.

Index the fields you filter on

The columns you filter by in every incident — service, route, status — should be indexed. Everything else can stay on the slow path.

Type your fields once

A field that is a string today and a number tomorrow is a query you cannot write. Assign types at ingest and hold the line: status is an integer, duration_ms is a float, service is an enum. The discipline costs a little up front and pays back every single investigation.

Query, do not grep

Once the fields are typed and indexed, the questions you used to answer with three chained grep | awk | sort pipes collapse into one line:

from logs | where service = "checkout" and status >= 500 | summarize count() by route

The log is a table. Treat it like one and the slow investigations become fast ones.