1. A system, comprising: a processor configured to: receive a query for retrieving stored log data that satisfies the query; query each of a plurality of log collector clusters for stored log data that satisfies the query; receive responses to the query from each of at least a subset of the plurality of log collector clusters, wherein to receive responses to the query from each of at least a subset of the plurality of log collector clusters comprises to receive an aggregated cluster response from a coordinator log collector of each of the at least subset of plurality of log collector clusters; and aggregate the received responses from the at least subset of the plurality of log collector clusters to generate a log report in response to the received query; and a memory coupled to the processor and configured to provide the processor with instructions.