Design the ingest-and-search backend of a centralized logging platform. Agents on a large host fleet ship structured JSON log lines; your system buffers them durably, indexes them for full-text and field search, and returns fast results when an engineer searches by keyword, field filters, and time range while investigating an incident.

Operating context. About 50,000 hosts ship logs at roughly 5,000,000 lines/sec at peak, average line 800 bytes. Searches are keyword plus field filters (service, level, host, trace_id) plus a time range — mostly the last few hours, occasionally back 14 days. Writes vastly outnumber reads. Data is time-partitioned; old partitions are queried rarely and eventually deleted.

Out of scope. The log-shipping agent, parsing and enrichment (assume lines arrive already structured), alerting on log patterns, and per-source access control. Assume those are handled elsewhere.

What to produce. A high-level architecture covering: the ingest and buffering path from agent to indexer; how logs are partitioned and sharded and what the index looks like (inverted index over time buckets); the search path that fans out across shards and merges results by recency with pagination; hot/warm/cold tiering and retention; and how you keep a heavy search from stalling ingest and vice versa. Sketch the components and the flow; we will probe specifics in checkpoints.