Access logs were one of the main motivations (lots of repeated queries like IP/user-agent/path/status). If you try it, two tips:

1) Index once, then iterate on searches: qlog index './access*.log' qlog search 'status=403'

2) If you’re hunting patterns (e.g. suspicious UAs or a specific path), qlog really shines because it doesn’t have to rescan the whole file on each query.

If you run into anything weird with common log formats (nginx/apache variants), feel free to paste a few sample lines and I’ll make the parser more robust.