Thing is that they could have preserved the textual nature and had some sort of external metadata to facilitate the ‘fanciness’. I have worked in other logging systems that did that, with the ability to consume the plaintext logs in an ‘old fashioned’ way but a utility being able to do all the nice filtering, search, and special event marking that journalctl provides without compromising the existence of the plain text.

But why?

I just can’t grasp why such elementary things need to be so fancied up.

It’s not like we don’t have databases and use them for relevant data. But this isn’t it.

And databases with hundreds of milions of rows are faster than journalctl (in my experience on the same hardware).