At my last company we had billions of lines of logs to go through every day. Most logs were in an ELB (Elastic Load Balancer; basically each log was a set of HTTP headers and GET params) format which were dumped to S3. We then used Athena queries to build a timeline of events as they passed through our various microservices. The benefit of Athena is that it's insanely fast to mount on top of S3 logs since it's AWS->AWS and you don't have to download hundreds of megabytes of logs to do your queries