look at victorialogs as an alternative to #elasticsearch
VictoriaLogs, a high performance log database. It’s not your average generic indexer like ElasticSearch and its ilk, nor is it anything like a traditional relational database. It shows some resemblance to document stores, but only on the surface. It is specifically built for logs. Structured data is indexed and tokenized. Due to tokenization, the on-disk (and thus, in-memory) data is a lot smaller, and many queries are considerably cheaper, even if performing a full scan: rather than comparing arbitrary long strings, it will compare much smaller, bounded integer tokens in most cases.