1. A method for processing semi-structured data comprising: storing a first plurality of log messages in a first data store during a first time period; responsive to receiving a first query having a field, extracting first field values for the field from the first plurality of log messages at the time of issuance of the first query; storing a second plurality of log messages in a second data store during a second time period subsequent to the first time period; updating an index of the second data store for second field values for the field extracted from the second plurality of log messages at the time of storing the second plurality of log messages; and responsive to receiving a second query having the field during the second time period, retrieving the second field values for the field from the index of the second data store.