You didn't use the query feature of journalctl, so you basically had it do an entire table conversion. Of course that's not going to show its performance value.

This is what you should be running for a proper comparison:

1. `echo 3 | sudo tee /proc/sys/vm/drop_caches`

2. `time journalctl -u ssh.service >/dev/null`

3. `journalctl >/tmp/all.log`

4. `echo 3 | sudo tee /proc/sys/vm/drop_caches`

5. `time grep -q sshd /tmp/all.log`