A method, performed by one or more processors, is disclosed, the method comprising receiving a stream of log data from one or more applications and indexing a plurality of different portions of the received stream to respective locations of a cold storage system. The method may also comprise storing, in an index, catalog pointers to the respective locations of the indexed portions in the cold storage system. One or more requests for log data may be received, and the method may also comprise subsequently identifying from the index catalog one or more pointers to respective indexed portions appropriate to at least part of the one or more requests, and sending of the identified one or more indexed portions to one or more hot storage systems each associated with a respective search node for processing of one or more search requests.