1. A network device, comprising: a transceiver for communicating with at least one client device over a network; a processor for enabling actions, the actions comprising: receiving event data and metadata that, characterizes the event data; when a feature within the received metadata is detected that is previously unwritten to a journal, writing to the journal the previously unwritten feature; identifying in the journal any feature for the event data that is different from a feature associated with an immediately preceding event data written in the journal; and writing to the journal the received event data, wherein the journal is subsequently useable to create a metadata file associated with the event data.