and answering my question, putting it in a rocksbd allow parsing when the eent occurs and fast db lookup to process the queries vs parsing the entire log file when queried so its indeed better 🙂