Why aggregate query with lookup is extremely slow?
It is slow because it is not using an index.  For each document in the logs collection, it is doing a full collection scan on the graphs collection.
From the $expr documentation page:

$expr only uses indexes on the from collection for equality matches in a $match stage.