DuckDB is amazing. It has completely replaced my need of using Cloudwatch or Loki etc for logs. I simply emit parquet to s3 now and use DuckDB to query locally. No HA compute or paying cloud tax for log search.

https://github.com/amr8t/blobsearch

You pay for transfers from s3 to local right?

I started with s3 and moved to R2. Log volumes are low enough that its covered in the free usage tier.

How big is your logs volume?