1. A method for processing semi-structured data comprising: storing a first plurality of log messages in a first data store during a first time period; responsive to receiving a first query having a field, extracting field values for the field from the first plurality of log messages at the time of issuance of the first query; storing a second plurality of log messages in a second data store during a second time period subsequent to the first time period; updating an index of the second data store for the field extracted from the second plurality of log messages at the time of storing the second plurality of log messages; and responsive to receiving a second query having the field during the second time period, retrieving field values for the field from the index of the second data store.